Authentication and encryption utilizing command identifiers

ABSTRACT

A data processing system, recording device, data processing method and program providing medium are provided to execute authentication processing and content storing processing between apparatuses. Program localization is employed to restrict access to program content. A plurality of key blocks store key data for authentication processing. Key block designation information is set in a recorder/reproducer, which is configured for executing authentication processing with the recording device by designating a key block. The recorder/reproducer can set a key block for each product, model or the like. In addition, data stored according to a selected key block cannot be utilized in a recorder/reproducer in which a different key block is set. Furthermore, an encryption processing controlling section of a recording device executes control in accordance with a pre-defined setting sequence. Furthermore, an illegal instrument that has not completed the authentication processing can be prevented from utilizing program content.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.11/642,704, filed Dec. 20, 2006, which is a divisional of U.S. patentapplication Ser. No. 10/412,771, filed on Apr. 11, 2003, which is acontinuation of U.S. patent application Ser. No. 09/937,120, filed Dec.17, 2001, the entire disclosures of which are hereby incorporated byreference herein.

BACKGROUND OF THE INVENTION

The present invention relates to a data processing apparatus, and a dataprocessing method, and more particularly, to a method and apparatus forverifying that data constituting a data content is valid, that is,checking whether or not the data has been tampered with; as well as amethod for imparting verification values; and also to an apparatus and amethod capable of enhancing security by generating individual keysnecessary for encryption processing using master keys corresponding totheir respective individual keys. Moreover the present inventionprovides a configuration that eliminates illegal usage of content data.More specifically, the invention relates to an apparatus and a methodcapable of identifying illegal reproduction devices and eliminatingillegal use of content. Furthermore, the present invention relates to anapparatus and a method capable of easily setting content only availableto the data processing apparatus using content data and content dataalso available to other data processing apparatuses based on informationspecific to the data processing apparatus, etc. Still further, thepresent invention relates to a method, apparatus and verification valueassignment method for verifying the validity of data configuring datacontents, that is, verifying the presence or absence of tampering.

Furthermore, the present invention relates to a data processingapparatus, a content data generating method, and a data processingmethod that realizes a content data configuration to provide and utilizecontent data under high security management. The content data is in aconfiguration in which data (including at least any one of voiceinformation, image information and program data) is applied toencryption processing. The content data is provided to a content usertogether with various kinds of header information, and the content userperforms reproduction, execution, or storing processing in a recordingdevice.

Still further, the present invention relates to a data processingapparatus, a data processing method and a content data generating methodfor providing a configuration for efficiently executing reproductionprocessing. For instance, the data contents may be compressed voicedata, image data or the like. More specifically, it enables aconfiguration of content data in which compressed data and an expansionprocessing program are combined to retrieve and extract an applicableexpansion processing program based on header information of compresseddata contents in which an applied expansion processing program is storedas header information to execute reproduction processing.

The present invention further relates to a configuration and method forreproducing various content such as sounds, images, games, or programswhich are available through various recording media. The recording mediainclude DVDs, CDs, wire or radio communication means such as CATV, theInternet, and satellite communication. Reproduction occurs in arecording and reproducing device of a user. The contents are stored inan exclusive recording device such as, for example, a memory card, ahard disk, or a CD-ROM. Use limitations, such as limitations selected bya content distributor, are stored along with content to provide securitysuch that the distributed content will not be illegally used.

Various data such as game programs, sound data, image data, ordocumenting programs (these are hereafter referred to as “contents”) arenow distributed via a network such as the Internet or via distributablestorage media such as DVDs or CDs. These distributed contents can bestored in a recording device such as a memory card or a hard disk thatis attached to a recording and reproducing apparatus such as a personalcomputer (PC) or a game apparatus of a user so that once stored, thecontents can be reproduced from the storage media.

The main components of a memory card used in a conventional informationapparatus such as a video game apparatus or a PC include a control meansfor controlling operations, a connector for connection to a slotconnected to the control means and formed in the information apparatus,and non-volatile memory connected to the control means for storing data.The non-volatile memory provided in the memory card comprises, forexample, an EEPROM, flash memory, or the like.

Various contents such as data or programs that are stored in the memorycard are invoked from the non-volatile memory in response to a user'scommand from an information apparatus main body such as a game apparatusor a PC. The game apparatus or PC can be used as a reproductionapparatus or to respond to a user's command provided via a connectedinput means. The contents are reproduced from the information apparatusmain body or from a display, speakers, or the like which are connectedthereto.

Software content such as game programs, music data or image datagenerally have their distribution rights held by their creators orsellers. Thus, in distributing this content, a configuration isgenerally used which places specified limitations on the usage. Thatmeans the use of software is permitted only for regular users so as toprevent unauthorized copying or the like. In other words, security istaken into consideration.

One method for realizing limitations on the use by a user is a processfor encrypting distributed content. This process comprises distributingvarious content such as sound data, image data, or game programs whichare encrypted, for example, via the Internet, and decrypting thedistributed content that has been encrypted. Decryption takes place onlyfor people confirmed to be regular users. Distributing the variouscontent corresponds to a configuration with a means for imparting adecryption key.

Encrypted data can be decrypted into, for example, plain text by adecryption process based on a predetermined procedure. A data encryptingand decrypting method that uses an encryption key for an informationencrypting process while using a decryption key for such a decryptionprocess is conventionally known.

There are various types of aspects of data encrypting and decryptingmethods using an encryption key and a decryption key. One example iscalled a common key cryptosystem. The common key cryptosystem uses acommon encryption key for a data encrypting process and a commondecryption key for a data decrypting process and imparts these commonkeys for the encryption and decryption processes to regular users whileexcluding data access by illegal users that have no key. Arepresentative example of this cryptosystem is the Data EncryptionStandard (DES).

The encryption and decryption keys used for the encryption anddecryption processes are obtained, for example, by applying a one-wayfunction such as a hash function based on a password or the like. Theone-way function makes it difficult to determine the input of thefunction from the output of the function. For example, a passworddecided by a user is used as an input to a one-way function so as togenerate an encryption key and a decryption key based on the output fromthe one-way function. Determining the password (which is the originaldata for the keys) from the encryption and decryption keys issubstantially impossible.

In addition, a method called a “public key cryptosystem” uses differentalgorithms for a process based on an encryption key used for encryptionand for a process based on a decryption key used for decryption. Thepublic key cryptosystem uses a public key available to unspecified usersso that an encrypted document for a particular individual is decryptedusing a public key issued by this particular user. The documentencrypted with the public key can only be decrypted with a secret keycorresponding to the public key used for the decryption process. Sincethe secret key is owned by the individual that has issued the publickey, the document encrypted with the public key can be decrypted only byindividuals having the secret key. A representative public keycryptosystem is the RSA (Rivest-Shamir-Adleman) encryption.

The use of such a cryptosystem enables encrypted contents to bedecrypted only for regular users. A conventional content distributingconfiguration employing such a cryptosystem will be described withreference to FIG. 1.

FIG. 1 shows an example of a configuration in which a reproduction means10 such as a PC or a game apparatus reproduces a program, sound or videodata, or the like (content) obtained from a data providing means such asa DVD or CD 30, or the Internet 40 and wherein data obtained from theDVD or CD 30, Internet 40, or the like are stored in a storage means 20such as a floppy disk, a memory card, a hard disk, or the like.

The content, such as a program, sound or video data, is provided to auser having the reproduction means 10. A regular user obtains encryptiondata as well as key data that are their encryption and decryption keys.

The reproduction means 10 has a CPU 12 to reproduce input data by meansof a reproduction process section 14. The reproduction process section14 decrypts encrypted data to reproduce content such as a providedprogram, sound or image data.

The regular user saves the content to the storage means 20 in order touse the provided program again. The reproduction means 10 has a storageprocess section 13 for executing this content storage process. Thestorage process section 13 encrypts and saves the data in order toprevent the data stored in the storage means 20 from being illegallyused.

A content encrypting key is used to encrypt the content. The storageprocess section 13 uses the content encrypting key to encrypt thecontent and then stores the encrypted content in a storage section 21 ofthe storage means 20 such as a floppy disk (FD), a memory card, or ahard disk.

To obtain and reproduce the stored content from the storage means 20,the user obtains encrypted data from the storage means 20 and causes thereproduction process section 14 of the reproduction means 10 to executethe decryption process using a content decrypting key. That is, thedecryption key is used in order to obtain and reproduce decrypted datafrom the encrypted data.

According to the conventional example of the configuration shown in FIG.1, the stored content is encrypted in the storage means 20 (such as afloppy disk or memory card) and thus cannot be read externally. When,however, this floppy disk is to be reproduced by a reproduction means ofanother information apparatus, such as PC or game apparatus, thereproduction is impossible unless the reproduction means has the samecontent key (i.e., the same decryption key for decrypting the encryptedcontent). Accordingly, to implement a form available to a plurality ofinformation apparatuses, a common decryption key must be provided tousers.

The use of a common content encrypting key, however, means that therewill be a higher possibility of distributing the encryption process keyto users not having a regular license. Consequently, it may not bepossible to prevent the illegal use of the content by users not havingthe regular license. Thus, it will be difficult to exclude the illegaluse in PCs, game apparatuses, or the like by users who do not have theregular license.

In case that key information leaks from one of the apparatuses, the useof common content encrypting key and decryption key can cause damage tothe whole system which utilizes the keys.

Furthermore, in an environment using a common key as described above, itis possible to easily copy, for example, content created on a certain PCand initially saved to a storage means such as a memory card or floppydisk, to a second floppy disk. Consequently, using the second copiedfloppy disk instead of the original content data will be possible sothat a large number of copied content data available to informationapparatuses such as game apparatuses or PCs may be created or tampered.

A method which is conventionally used includes verifying an integritycheck value in content data to check the validity of the data. That is,in order to determine whether or not the data have been tampered with, arecording and reproducing device collates an integrity check value(generated based on the data to be verified) with the integrity checkvalue contained in the content data to verify the data.

The integrity check value for the data content, however, is generallygenerated for the entire set of data. Collating the integrity checkvalue generated for the entire set of data requires a integrity checkvalue to be generated for the entire set of data to be checked. If, forexample, a integrity check value (ICV) is to be determined using aMessage Authentication Code (MAC) generated in a DES-CBC (Cipher BlockChaining) mode, the DES CBC process must be executed on the entire setof data. The amount of such calculations increases linearly with thedata length, thereby disadvantageously reducing processing efficiency.

SUMMARY OF THE INVENTION

The present invention solves the above problems with the conventionalart. The present invention provides, as a first object of the invention,a data processing apparatus and method and a data verifying valueimparting method, which efficiently confirms the validity of data andefficiently executes a download process for a recording device. Thedownload process is executed after the verification. A reproductionprocess is also executed after the verification along with otherprocesses. A program providing medium for use in this apparatus andthese methods is also presented.

Furthermore, as techniques for limiting the use of content data toauthorized users, various kinds of encryption processing are available,such as data encryption, data decryption, data verification andsignature processing. However, executing these kinds of encryptionprocessing requires common secret information. For example, commonsecret information is used in key information applied to encryption anddecryption of content data, or to an authentication key used forauthentication shared between two apparatuses (i.e., apparatuses betweenwhich content data is transferred or apparatuses between whichauthentication processing is executed).

Therefore, in the case where key data (which is shared secretinformation), is leaked from either of the two apparatuses, the contentencryption data (using the shared key information) can also be decryptedby a third party who has no license, thus allowing illegal use ofcontents. The same is true for the case where an authentication key isleaked This can lead to establishing an authentication for an apparatuswith no license. Leakage of keys, therefore, has consequences thatthreat the entire system.

The present invention is intended to solve these problems.

The second object of the invention is to provide a data processingapparatus, data processing system and data processing method withenhanced security in encryption processing. The data processingapparatus of the present invention does not store individual keysnecessary to execute encryption processing such as data encryption, datadecryption, data verification, authentication processing and signatureprocessing in a storage section. Instead, the data processing apparatusstores master keys to generate these individual keys. The master keysare stored in the storage section and allows an encryption processingsection to generate necessary individual keys based on the master keysand identification data of the apparatus or data.

Furthermore, it is possible to maintain a certain degree of security bysupplying data encrypted content. However, in the case where variousencryption keys stored in memory are read and leaked through illegalreading of memory, key data, etc. and copied on a recorder/reproducerwithout any authorized license, contents may be illegally used using thecopied key information.

It is a third object of the present invention to provide a dataprocessing apparatus, data processing method and content data generationmethod in a configuration capable of excluding such illegal reproducers.That is, a configuration that is capable of identifying illegalreproducers and not allowing the identified illegal reproducers toexecute processing such as reproduction and downloading of content data.

Furthermore, techniques for limiting the use of content data toauthorized users include encryption processing using predeterminedencryption keys, for example, signature processing. However,conventional encryption using signature processing generally has asignature key common to all entities using the content in a system. Sucha common signature key allows different apparatuses to use commoncontent. This can lead to illegal copies of contents.

It is possible to store encrypted contents using a unique password,etc., but the password may be stolen. It is also possible to decrypt thesame encrypted data content by entering the same password throughdifferent reproducers. However, it is difficult for a conventionalsecurity configuration to implement a system that can identify areproducer that only allows the reproducer to use the contents.

The present invention has been implemented to solve the above problemsof the prior art. It is a fourth object of the present invention toprovide a data processing apparatus and data processing method capableof allowing only a specific data processing apparatus to reproducecontents according to contents utilization restrictions. This is done bymaking it possible to selectively use both an apparatus-specific key,which is specific to a data processing apparatus, and a system commonkey, which is common to other data processing apparatuses.

Furthermore, encryption processing of content data is used as a methodof limiting utilization of content data to only authorized users.However, there are various kinds of content data, such as voiceinformation, image information and program data. There are various kindsof content in cases such as (a) where all content data is required to beencrypted, and (b) where a part requiring encryption processing and apart not requiring encryption processing are mixed.

Applying encryption processing uniformly to various content may generateunnecessary decryption processing in reproduction processing of thecontents. It may also generate unfavorable situations in terms ofprocessing efficiency and processing speed. For example, for data suchas music data in which real time reproduction is essential, it isdesirable to have a content data structure that can apply decryptionprocessing in high speed processing.

The present invention solves such problems. It is a fifth object of thepresent invention to provide a data processing apparatus, a content datagenerating method and a data processing method to apply various datastructures corresponding to types of content data to specific content.In other words, various different data formats are providedcorresponding to the content. This enables generation and processing ofcontent data in a manner that has high security and easy to utilize inreproduction, execution and the like.

Furthermore, voice data, image data and the like that are decrypted arethen output to an AV output section to be reproduced. Nowadays, oftentimes, content is compressed and stored in a storage medium ordistributed. It is therefore necessary to expand the compressed databefore reproducing it. For example, if voice data is compressed in theMP-3 format, the voice data will be decrypted by a MP3 decoder. Ifcontent data is image data which is compressed in the MP-3 format, thevoice data is expanded by a MPEG2 decoder to be output.

However, as there are various kinds of compression processing andexpansion processing programs, even if compressed data is provided froma content provider via a medium or a network, it can be impossible toreproduce the data with a reproducing apparatus that does not have acompatible expansion program.

It is a sixth object of the present invention to provide a configurationfor efficiently executing reproduction processing of compressed data.That is, a data processing apparatus, a data processing method and acontent data generating method for efficiently executing reproductionprocessing are presented in the case in which the content is compressedvoice data, image data or the like.

The foregoing objects and other objects of the invention have beenachieved by providing a data processing apparatus and a data processingmethod.

In accordance with an embodiment of the present invention, a data recordreproducing player is provided. The data record reproducing player iscapable of reproducing program content. It comprises a recording device,an encryption processing unit, an input unit and a control unit. Therecording device is operable to record save data of the program content.The encryption processing unit is operable to execute an encryptionprocess and a decryption process on the save data. The encryptionprocessing unit employs a cryptographic key for executing the encryptionprocess and the decryption process. The input unit is operable to entera program localization on the save data, wherein the programlocalization is maintained in a data management file. The control unitis capable of accessing the data management file and is operable todetermine an encryption processing method and a decryption processingmethod for the save data. The encryption processing method is capable ofusing the cryptographic key and is determined according to the programlocalization. The encryption processing method is adapted for storingthe save data in the recording device. The decryption processing methodis determined according to the program localization and is adapted forreproducing the cryptographic key.

In an example, the program content includes an identifier and theprogram localization is a program restriction that enables use of thesave data depending on the identifier. The data management file isstructured as a table for storing the program restriction depending uponthe identifier. In this example, if the program restriction provides forrestriction of the program content, the encryption processing unitexecutes the encryption processing method or the decryption processingmethod on the save data using a save data encryption key of the programcontent. In this case, the save data encryption key is based on at leastone of an individual encryption key or individual information of theprogram content. If the program restriction provides for no restrictionof the program content, the encryption processing unit executes theencryption processing method or the decryption processing method on thesave data using at least one of a system-shared encryption key and asystem save data encryption key. The system save data encryption key isbased on the system-shared encryption key. The system-shared encryptionkey is stored in the data record reproducing player. In this example,the individual encryption key is preferably a content key Kcon that iscapable of being stored in a header portion of content data, and thesystem-shared encryption key is a system signature key Ksys that iscapable of being stored in a plurality of different data recordreproducing players.

In another example, the data record reproducing player further comprisesidentity information. In this example, the program localization is arecord reproducing player restriction that enables use of the save datadepending on the identity information. The data management file isstructured as a table for storing the record reproducing playerrestriction in correspondence with an identifier of the program content.In this example, if the record reproducing player restriction providesfor restriction of a record reproducing player, the encryptionprocessing unit executes the encryption processing method or thedecryption processing method on the save data using a save dataencryption key of the record reproducing player. The save dataencryption key is based on at least one of an individual encryption keyof the data record reproducing player and individual information. If therecord reproducing player restriction provides for no restriction of therecord reproducing player, the encryption processing unit executes theencryption processing method or the decryption processing method on thesave data using at least one of a system-shared encryption key and ashared save data encryption key. The shared save data encryption key isbased on the system-shared encryption key. The system-shared encryptionkey is stored in the data record reproducing player. In this example,the individual encryption key is preferably an individual signature keyKdev that is capable of being stored in the data record reproducingplayer, and the system-shared encryption key is a system signature keyKsys that is capable of being stored in a plurality of specific datarecord reproducing players.

In a further example, the program content includes an identifier and theprogram localization is a user restriction that enables use of the savedata depending on a user's identity. In this example, the datamanagement file is structured as a table for storing the userrestriction depending upon the identifier. If the user restrictionprovides for restriction of the user, the encryption processing unitexecutes the encryption processing method or the decryption processingmethod on the save data using a user save data encryption key. The usersave data encryption key is based on a password received by the inputunit. If the user restriction provides for no restriction of the user,the encryption processing unit executes the encryption processing methodor the decryption processing method on the save data using at least oneof a system-shared encryption key and a shared save data encryption key.The shared save data encryption key is based on the system-sharedencryption key. The system-shared encryption key is stored in the datarecord reproducing player. In this example, the system-shared encryptionkey is preferably a system signature key Ksys that is capable of beingstored in a plurality of record reproducing players.

In accordance with another embodiment of the present invention, a savedata processing method for use in a data record reproducing player isprovided. The method is capable of reproducing program content. Themethod comprises obtaining an input of program localization anddetermining an encryption processing mode for storing save data into arecording device according to the program localization. An encryptionkey is selected according to the encryption processing mode. Also,encryption processing is executed on the save data using the encryptionkey.

In an example, the program content includes an identifier and theprogram localization is a program restriction that enables use of thesave data depending on the identifier. In this example, if the programrestriction provides for restriction of the program content, theencryption key is selected from one of an individual encryption key anda save data encryption key. The save data encryption key is based on atleast one of the individual encryption key and individual information.If the program restriction provides for no restriction of the programcontent, the encryption key is selected from one of a system-sharedencryption key and a shared save data encryption key. The shared savedata encryption key is based the system-shared encryption key. Thesystem-shared encryption key is stored in the data record reproducingplayer.

In another example, the data record reproducing player includes identityinformation, and the program localization is a record reproducing playerrestriction that enables use of the save data depending on the identityinformation. In this example, if the record reproducing playerrestriction provides for restriction of a record reproducing player, theencryption key is selected from one of an individual encryption key ofthe data record reproducing player and an individual save dataencryption key of the record reproducing player. The individual savedata encryption key is based on at least one of the individualencryption key and individual information. If the record reproducingplayer restriction provides for no restriction of the record reproducingplayer, the encryption key is selected from one of a system-sharedencryption key and a shared save data encryption key. The shared savedata encryption key is based on the system-shared encryption key. Thesystem-shared encryption key is stored in the data record reproducingplayer.

In a further example, the program localization is a user restrictionthat enables use of the save data depending on a user's identity. Inthis example, if the user restriction provides for restriction of theuser, the encryption key is selected from one of a password and anindividual save data encryption key. The individual save data encryptionkey is based on the password. If the user restriction provides for norestriction of the user, the encryption key is selected from one of asystem-shared encryption key and a shared save data encryption key. Theshared save data encryption key is based on the system-shared encryptionkey. The system-shared encryption key is stored in the data recordreproducing player.

In accordance with yet another embodiment of the present invention, asave data processing method for use in a data record reproducing playeris provided. The data record reproducing player is capable ofreproducing program content. In the method, a decryption processing modeis determined for reproducing save data according to a programlocalization. The program localization is provided as a data managementfile. The save data is retrieved from a recording device. A decryptionkey is selected according to the decryption processing mode, anddecryption processing is executed on the save data using the decryptionkey.

In an example of this embodiment, the program content includes anidentifier, and the program localization is a program restriction thatenables use of the save data depending on the identifier. Furthermore,if said program restriction provides for restriction of the programcontent, the decryption key is selected from an individual decryptionkey and a save data decryption key. The save data decryption key isbased on at least one of the individual decryption key and individualinformation. If the program restriction provides for no restriction ofthe program content, the decryption key is selected from one of asystem-shared decryption key and a shared save data decryption key. Theshared save data decryption key is based on the system-shared decryptionkey. The system-shared decryption key is stored in the data recordreproducing player.

In another example of this embodiment, the data record reproducingplayer includes identity information, and the program localization is arecord reproducing player restriction that enables use of the save datadepending on the identity information. In this example, if the recordreproducing player restriction provides for restriction of a recordreproducing player, the decryption key is selected from one of anindividual decryption key of the data record reproducing player and anindividual save data decryption key of the record reproducing player.The individual save data decryption key is based on at least one of theindividual decryption key and individual information. If the recordreproducing player restriction provides for no restriction of the recordreproduction player, the decryption key is selected from one of asystem-shared decryption key and a shared save data decryption key. Theshared save data decryption key is based on the system-shared decryptionkey. The system-shared decryption key is stored in the data recordreproducing player.

In a further example of this embodiment, the program localization is auser restriction that enables use of the save data depending on a user'sidentity. If the user restriction provides for restriction of the user,the decryption key is selected from one of a password and an individualsave data decryption key. The individual save data decryption key isbased on said password. If the user restriction provides for norestriction of the user, the decryption key is selected from one of asystem-shared decryption key and a shared save data decryption key. Theshared save data decryption key is based on the system-shared decryptionkey. The system-shared decryption key is stored in the data recordreproducing player.

In accordance with a further embodiment of the present invention, arecording medium recorded with a computer program is provided. Thecomputer program is capable of executing a save data process havingcertain actions to perform in a data record reproducing player. The datarecord reproducing player is capable of reproducing program content on acomputer system. The actions include determining an encryptionprocessing mode according to a program localization obtained from aninput unit. The encryption processing mode is adapted for storing savedata into a recording device. An encryption key is selected according tothe encryption processing mode. Encryption processing is executed on thesave data using the encryption key.

In accordance with yet another embodiment of the present invention, arecording medium recorded with a computer program is provided. Thecomputer program is capable of executing a save data process havingcertain actions to perform in a data record reproducing player. The datarecord reproducing player is capable of reproducing program content on acomputer system. The actions include determining a decryption processingmode according to a program localization stored in a data managementfile. The decryption processing mode is adapted to reproduce save dataretrieved from a recording device. A decryption key is selectedaccording to the decryption processing mode. Decryption processing isexecuted on the data using the decryption key.

In accordance with another embodiment of the present invention, a dataprocessing system is provided. The system comprises a recording deviceand a recorder/reproducer. The recording device has a data storingsection for storing content data and a plurality of key blocks forstoring key data applicable to authentication processing. The key datain each one of the plurality of key blocks is distinct to that keyblock. The recorder/reproducer is operable to perform the authenticationprocessing with the recording device, to designate a first key block outof the plurality of key blocks, and to execute the authenticationprocessing with the recording device based on the key data stored in thefirst key block. Transfer of the content data between therecorder/reproducer and the recording device is enabled when theauthentication processing is successful. Preferably, the key data ineach of the plurality of key blocks includes an authentication key.

In an example of this embodiment, the recorder/reproducer includessetting information in which one key block of the plurality of keyblocks is capable of being applied to the authentication processing as adesignated key block. The setting information is stored in a memory inthe recorder/reproducer. When the authentication processing is performedbetween the recorder/reproducer and the recording device, therecorder/reproducer determines the designated key block based on thesetting information. Preferably, the setting information is differentfor each of a plurality of product units.

In another example of this embodiment, the recorder/reproducer includesa memory for storing the key data. In this example, authentication ofthe key data stored in the memory is only established using the key datain a selected key block in the recording device.

In yet another example of this embodiment, the data processing systemfurther comprises a memory in the recorder/reproducer, a master keyMkake, and an authentication key Kake. The master key Mkake is stored inthe recorder/reproducer memory. The authentication key Kake is generatedbased on the master key Mkake, wherein authentication of theauthentication key Kake is only established in the authenticationprocessing using the key data in a selected key block in therecorder/reproducer. In this example, the data processing systempreferably further comprises a memory in said recording device andrecording device identification information IDmem stored in therecording device. In such a case, the recorder/reproducer is operable togenerate the authentication key Kake by encryption processing of therecording device identification information IDmem based on the masterkey Mkake, and to perform the authentication processing with theselected key block of the recording device using the authentication keyKake. The authentication key Kake is preferably a plurality of distinctauthentication keys Kake each associated with one of the plurality ofkey blocks.

In a further example of this embodiment, the recorder/reproducerincludes a data storage section for storing storage data. In thisexample, each key block of the recording device includes recordingdevice identifier information, an authentication key, a random numbergeneration key and a storing key. The recording device identifierinformation contains specific information about the recording device.The authentication key is adapted for use in the authenticationprocessing. The random number generation key is adapted for use in theauthentication processing. The storing key is adapted for use inencryption processing of the storage data.

In this example, the storing key preferably includes a plurality ofdistinct storing keys each stored in one of the plurality of key blocks.The plurality of distinct storing keys is capable of use in theencryption processing of the storage data. Also, the recording device isoperable to execute key exchange processing of the plurality of distinctstoring keys, and, if a data utilization request is received by therecording device, the recording device is operable to output encryptiondata using a key that is different from the plurality of distinctstoring keys.

In another example of this embodiment, the recording device furtherincludes an encryption processing section operable to select the firstkey block in accordance with key block designation information receivedfrom the recorder/reproducer, and to execute the authenticationprocessing with the recorder/reproducer using the key data in the firstkey block. Preferably, the encryption processing section of therecording device is operable to execute encryption processing using thekey data in the first key block.

In yet another example of this embodiment, the data processing systemfurther comprises a plurality of designatable key blocks in therecording device. At least one of the designatable key blocks isconfigured as a commonly designatable key block that is designatable inrecorder/reproducers other than the recorder/reproducer.

In accordance with a further embodiment of the present invention, arecording device is provided, which comprises a data storage section anda plurality of key blocks. The data storage section stores content datatransferable to and from an external apparatus. The plurality of keyblocks stores key data. The key data is applicable to authenticationprocessing between the recording device and the external apparatus,wherein the key data is operable to store information for each of theplurality of key blocks. Preferably, each of the plurality of key blocksincludes a unique authentication key for use with the authenticationprocessing, and each unique authentication key is configured as the keydata.

In an example of this embodiment, the recording device further comprisesa memory and a distinct authentication key Kake. The memory is forstoring recording device identification information IDmem. The distinctauthentication key Kake is for each of the plurality of key blocks. Eachof the distinct authentication keys Kake is stored in one of theplurality of key blocks.

In another example of this embodiment, each of said plurality of keyblocks includes recording device identifier information, anauthentication key, a random number generation key and a storing key.The recording device identifier information contains specificinformation about the recording device. The authentication key isadapted for use in the authentication processing. The random numbergeneration key is adapted for use in the authentication processing. Thestoring key is adapted for use in encryption processing of storage datain the data storage section.

In this example, the storing key preferably includes distinct key datathat is different for each of the plurality of key blocks. The storingkey is usable in the encryption processing. Furthermore, the recordingdevice is preferably operable to execute key exchange processing of thestoring key, and, if a data utilization request is received by therecording device, he recording device is preferably operable to outputencryption data using a key that is different from the storing key.

In a further example of this embodiment, the recording device furtherincludes an encryption processing section. The encryption processingsection is operable to select a specific key block from the plurality ofkey blocks in accordance with key block designation information receivedfrom the external apparatus. The encryption processing section is alsoable to execute the authentication processing using the key data in thespecific key block. The encryption processing section is preferablyoperable to execute encryption processing using the key data in thespecific key block.

In accordance with another embodiment of the present invention, a dataprocessing method is provided for use in a data processing system. Thedata processing system includes a recorder/reproducer and a recordingdevice operable to transmit encryption data to each other. The dataprocessing method comprises designating in the recorder/reproducer aselected key block out of a plurality of key blocks held by he recordingdevice and executing authentication processing between therecorder/reproducer and the recording device based on key data stored inthe selected key block. Preferably, each of the plurality of key blocksincludes an authentication key for use in the authentication processing,and the authentication key of each of the plurality of key blocks isconfigured as distinct key data. Alternatively, the authenticationprocessing step includes designating the selected key block based onsetting information held in a memory in the recorder/reproducer.

In an example, the embodiment further comprises storing a master keyMkake for a recording device authentication key in a memory in therecorder/reproducer. This example also includes generating anauthentication key Kake based on the master key Mkake for use in theauthentication processing. In this example, the recording devicepreferably includes a memory for storing recording device identificationinformation IDmem, and each of the plurality of key blocks stores theauthentication key Kake. The authentication key Kake is distinct foreach key block. Furthermore, the data processing method preferablyfurther includes executing encryption processing of the recording deviceidentification information IDmem based on the master key Mkake togenerate the authentication key Kake.

In another example, the selected key block is preferably designated inaccordance with key block designation information received from therecorder/reproducer.

In yet another example, the method further comprises executingencryption processing in the recording device using the key data in theselected key block. In this example, the selected key block is selectedin accordance with key block designation information received from therecorder/reproducer, and the encryption processing is executed duringdata storing processing and during data transfer processing of contentdata in a data storing section of the recording device.

In a further example, the recording device further includes a datastorage section, and each of the plurality of key blocks of therecording device includes a storing key used in encryption processing ofthe stored in the data storage section. In this example, the methodfurther comprises executing key exchange processing of the storing keyin the recording device. If a data utilization request that is encryptedby the storing key is received from outside the recording device, theencryption data is output by a key different from the storing key tooutside the recording device.

In accordance with yet another embodiment of the present invention, arecording medium recorded with a computer program is provided. Thecomputer program is for executing data processing in a data processingsystem, which includes a recorder/reproducer and a recording deviceoperable to transmit encryption data to each other. The data processingcomprises designating in the recorder/reproducer a selected key blockout of a plurality of key blocks held by the recording device andexecuting authentication processing between the recorder/reproducer andthe recording device based on key data stored in the selected key block.

In accordance with a further embodiment of the present invention, a dataprocessing system is provided. The system is operable to transmitencryption data, and comprises a first apparatus and a second apparatus.The first apparatus has a command identifier. The second apparatus hasan encryption processing section that is capable of executing encryptionprocessing on data transmitted to and from the first apparatus. Theencryption processing section including a control section operable toreceive the command identifier in accordance with a pre-defined settingsequence and to retrieve a command from a register. The commandcorresponds to the command identifier. The control section is alsooperable to have the command executed. In this embodiment, if thecommand identifier differs from the predefined setting sequence, thecontrol section is operable to cancel execution of the command.

In an example of this embodiment, the pre-defined setting sequence is acommand number setting sequence in which numbers are sequentiallyincremented. The control section is thus operable to store a value ofthe command identifier received from the first apparatus in a memory. Itis also operable to determine coincidence of a new command identifierreceived from the first apparatus with the pre-defined setting sequencebased on the received value stored in the memory. If the new commandidentifier is different from the pre-defined setting sequence, thecontrol section is operable to reset the command identifier stored inthe memory without performing command processing corresponding to thenew command identifier.

In another example of this embodiment, the data processing systemfurther comprises a command register, an authentication processingcommand sequence, an encryption processing command sequence, and asequence. The command register is within the second apparatus, and isfor storing the command in accordance with the pre-defined settingsequence. The authentication processing command sequence is forexecuting authentication processing between the first apparatus and thesecond apparatus. The encryption processing command sequence is forexecuting the encryption processing. The sequence is set such that anauthentication command identifier corresponding to the authenticationprocessing command sequence is executed prior to a command sequencecorresponding to the encryption processing command sequence.

In this example, the encryption processing command sequence preferablyincludes at least one of encryption key exchange processing forencryption data transferred from the first apparatus to the secondapparatus and stored in a storage unit in said second apparatus, andencryption key exchange processing for the encryption data stored in thestorage unit in the second apparatus and transferred from the secondapparatus to the first apparatus. More preferably the control section isoperable to manage an order of command execution based on thepre-defined setting sequence and the command identifier in theencryption key exchange processing. In this case, when the commandprocessing is different from the pre-defined setting sequence, thecontrol section does not accept command processing from an externalapparatus, including the first apparatus, during command executionrelating to the encryption key exchange processing.

Alternatively in this example, if authentication is established betweenthe first apparatus and the second apparatus, the control section isoperable to perform certain operations. The operations include settingan authentication flag indicating that the authentication processing isfinished. The operations also include executing command managementcontrol to enable execution of the encryption processing commandsequence during setting of the authentication flag. The operationsfurther include resetting the authentication flag when repeating theauthentication processing command sequence.

In a further example of this embodiment, the second apparatus is astorage device having a data storage section for storing the encryptiondata. Also in this example, the first apparatus is a recorder/reproducerfor storing data in the storage device and for retrieving the datastored in the storage device to reproduce and execute the data. Therecorder/reproducer includes an encryption processing section forexecuting the encryption processing of the transmission data with thestorage device.

In this example, the storage device preferably includes a key block forstoring an authentication key and a storing key. The authentication keyis usable in authentication processing between the recorder/reproducerand the storage device. The storing key is usable as an encryption keyfor the encryption data stored in the data storing section of thestorage device. The control section is operable to receive a commandidentifier from the recorder/reproducer, to execute authenticationprocessing using the authentication key in accordance with thepre-defined setting sequence, and, after completing the authenticationprocessing, to execute the encryption processing of data accompanyingkey exchange processing using the storing key.

More preferably, the key block includes a plurality of key blocks eachstoring the authentication key and the storing key. In this case, theauthentication key is different from the storing key. Therecorder/reproducer is operable to notify the storage device of one keyblock as a designated key block out of the plurality of key blocks. Thedesignated key block is used in the authentication processing and theencryption processing. The storage device is operable to execute theauthentication processing using the authentication key stored in thedesignated key block and to execute the encryption processing of thedata using the storing key in the designated key block.

In accordance with another embodiment of the present invention, arecording device is provided. The recording device comprises a datastorage section and an encryption processing section. The data storagesection is operable to store content data that is transferable to anexternal apparatus. The encryption processing section is operable toexecute encryption processing of transmission data with the externalapparatus. The encryption processing section includes a control sectionoperable to receive a command identifier transferred from the externalapparatus in accordance with a setting sequence and to retrieve acommand from a register. The command corresponds to the commandidentifier. The control section is also operable to have the commandexecuted. If the command identifier differs from the setting sequence,the control section is operable to cancel processing of the command.

Preferably, the control section further includes a command numbersetting sequence in which numbers are sequentially incremented as thesetting sequence. Also, the control section is preferably furtheroperable to perform certain functions. A function is to store a receivedvalue of the command identifier in a memory. Another function is todetermine coincidence of a new command identifier received from theexternal apparatus with the setting sequence based on the receivedvalue. If it is determined that the new command identifier is differentfrom the setting sequence, another function is to reset the receivedvalue stored in the memory without performing command processingcorresponding to the new command identifier.

In an example, this embodiment further comprises a command register, anauthentication processing command sequence, an encryption processingcommand sequence and a sequence. The command register is for storing thecommand in accordance with the setting sequence. The authenticationprocessing command sequence is for executing authentication processingbetween the external apparatus and the recording device. The encryptionprocessing command sequence is for executing the encryption processingrelating to transferred data between the external apparatus and therecording device. The sequence is set such that the command identifiercorresponding to the authentication processing command sequence isexecuted prior to a command sequence corresponding to the encryptionprocessing command sequence.

In this example, the encryption processing command sequence preferablyincludes at least one of encryption key exchange processing forencryption data transferred from the external apparatus to the recordingdevice and stored in a storage unit in the recording device, andencryption key exchange processing for the encryption data stored in thestorage unit and transferred from the recording device to the externalapparatus. More preferably, the control section is operable to manage anorder of command execution based on the setting sequence and the commandidentifier in the encryption key exchange processing. Here, the controlsection does not accept command processing from the external apparatusduring the command execution relating to the encryption key exchangeprocessing when the command processing is different from the settingsequence.

Alternatively in this example, the control section is operable toperform certain operations. An operation is to set an authenticationflag. Another operation is to execute command management control. Yetanother operation is to reset the authentication flag when repeating theauthentication processing command sequence. If authentication isestablished between the external apparatus and the recording device, theauthentication flag is set to indicate that the authenticationprocessing is finished. The command management control enables executionof the encryption processing command sequence during setting of theauthentication flag.

In yet another example, the recording device further comprises a keyblock. The key block is for storing an authentication key and a storingkey. The authentication key is usable in authentication processingbetween the external apparatus and the recording device. The storing keyis usable as an encryption key for the data stored in the data storagesection. In this example, the control section is operable to receive thecommand identifier from the external apparatus, to execute theauthentication processing using the authentication key, and aftercompleting the authentication processing, to execute the encryptionprocessing of data accompanying key exchange processing using thestoring key.

In this example, the key block preferably includes a plurality of keyblocks, which each store the authentication key and the storing key. Inthis case, the external apparatus is operable to notify the recordingdevice of one key block out of the plurality of key blocks. The one keyblock is a designated key block used in authentication processing andencryption processing of selected data. The recording device is operableto execute the authentication processing using the authentication keystored in the designated key block to execute the encryption processingusing the storing key in the designated key block.

In accordance with a further embodiment of the present invention, a dataprocessing method is provided for use in a data processing system. Thesystem has a first apparatus and a second apparatus operable to transmitencryption data to each other. The method comprises executing commandprocessing control in the second apparatus for receiving a commandidentifier in accordance with a setting sequence. The command identifieris transferred from the first apparatus. The method also comprisesretrieving a command corresponding to the command identifier from aregister. The method further comprises processing the command. If thecommand identifier is different from the setting sequence, the methodalso comprises canceling the processing of the command.

In an example of this embodiment, the setting sequence is a commandnumber setting sequence in which numbers are sequentially incremented.Also, the command processing control includes storing a receiving valueof the command identifier in a memory and determining coincidence of anew command identifier received from the first apparatus with thesetting sequence based on the receiving value. If the new commandidentifier is different from the setting sequence, the receiving valuestored in the memory is reset without performing command processingcorresponding to the new command identifier.

In another example of this embodiment, the command processing controlincludes executing an authentication processing command sequence forexecuting authentication processing between the first apparatus and thesecond apparatus. This example also includes executing an encryptionprocessing command sequence for executing encryption processing relatingto transferred data between the first apparatus and the secondapparatus. The setting sequence is a sequence for executing theauthentication processing command sequence prior to the encryptionprocessing command sequence.

In this example, the encryption processing command sequence preferablyincludes at least one of encryption key exchange processing forencryption data transferred from the first apparatus to the secondapparatus and stored in a storage unit in the second apparatus, andencryption key exchange processing for the encryption data stored in thestorage unit in the second apparatus and transferred from the secondapparatus to the first apparatus. More preferably, the commandprocessing control includes additional actions. During processing of aseries of commands relating to the encryption key exchange processing,an action includes managing an order of command processing based on thesetting sequence and the command identifier. Another action includes notaccepting command processing from an external apparatus when the commandprocessing is different from the setting sequence.

Alternatively, if authentication is established between the firstapparatus and the second apparatus, this example further includessetting an authentication flag indicating that the authenticationprocessing is finished. The example also further includes executingcommand management control during the command processing control toenable execution of the encryption processing command sequence whensetting the authentication flag. In this case, the method preferablyfurther includes resetting the authentication flag when executing a newauthentication processing command sequence.

In accordance with yet another embodiment of the present invention, arecording medium recorded with a computer program is provided. Thecomputer program is for executing data processing having certain actionsin a data processing system. The system includes a first apparatus and asecond apparatus operable to transmit encryption data to each other. Anaction is receiving a command identifier that is transferred from thefirst apparatus to the second apparatus in accordance with a settingsequence. Another action is retrieving a command corresponding to thecommand identifier from a register. A further action is processing thecommand. If the command identifier is different from the settingsequence, another action is canceling the processing of the command.

Other objects, features, and advantages of the present invention will beseen from the detailed explanation based on the embodiment and attacheddrawings of the present invention described later.

As described above, according to the data processing apparatus andmethod and data-verifying-value-imparting method of the presentinvention, partial integrity check values generated as integrity checkvalues for a partial data set containing one or more partial dataobtained by dividing content data into a plurality of pieces are usedfor a collation process to verify the partial data, and apartial-integrity-check-value-verifying integrity check values used toverify a partial integrity check value set comprising a combination of aplurality of partial integrity check values are used for a collationprocess to verify the entirety of a plurality of partial data setscorresponding to a plurality of partial integrity check valuesconstituting a partial integrity check value set. Consequently, comparedto a configuration for imparting a single integrity check value to theentire content data, partial verification is achieved and the entireverification process is efficient due to the use of the partialintegrity check values.

Further, according to the data processing apparatus and method anddata-verifying-value-imparting method of the present invention, theverification process can be executed depending on how content data areused, for example, whether the data are to be downloaded or reproduced;for example, a verification process for a data portion that is unlikelyto be tampered can be omitted. Therefore, efficient verification isachieved depending on how data is used.

Furthermore, the data processing apparatus and data processing method ofthe present invention are configured in such a way that individual keysnecessary to execute encryption processing such as data encryption, datadecryption, data verification, authentication processing and signatureprocessing are not stored in a storage section, master keys to generatethese individual keys are stored in the storage section instead, theencryption processing section of the data processing apparatus extractsthe master keys corresponding to these individual keys such asencryption keys and authentication keys from the storage section asrequired, executes encryption processing applying a DES algorithm, etc.based on the extracted master keys and identification data of theapparatus or data and generates individual keys such as an encryptionkey and authentication key, and therefore the present inventioneliminates the possibility of the individual keys themselves leakingfrom the storage section and enhances the security of an encryptionprocessing system because acquiring the individual keys will require aplurality of information pieces such as information of both individualkey generation algorithm and master keys, identification data of theapparatus or data. Moreover, even if an individual key is leaked forsome reasons, the range of damage is limited to the range of theindividual key, which will not lead to collapse of the entire system.

Furthermore, the data processing apparatus, data processing system anddata processing method of the present invention is configured in such away that individual keys are sequentially generated based on theidentification data of the apparatus or data, which eliminates the needto maintain the list of keys applied to individual apparatuses in acontrol apparatus, facilitating system control as well as enhancing thesecurity.

Furthermore, according to the data processing apparatus, data processingmethod and contents data generation method of the present invention,illegal device identification data information is stored in contentsdata, collation between an illegal device list and therecorder/reproducer identifier of the recorder/reproducer attempting touse the contents is executed prior to the use of the contents by therecorder/reproducer, and in the case where the collation result showsthat some entries of the illegal device list match therecorder/reproducer identifier, the subsequent processing, for example,contents data decryption, downloading or reproduction processing, etc.is stopped, thus making it possible to prevent a reproducer, etc. thathas illegally acquired a key from illegally using contents.

Furthermore, the data processing apparatus, data processing method andcontents data generation method of the present invention adopt aconfiguration allowing the contents data to include check valuestogether for the illegal device list in the content data, making itpossible to prevent tampering of the list itself and provide a contentsdata utilization configuration with enhanced security.

Furthermore, the data processing apparatus and data processing method ofthe present invention allows a data processing apparatus such as arecorder/reproducer and PC to store an apparatus-specific key, which isspecific to the data processing apparatus and a system common key, whichis common to other data processing apparatuses using contents data,making it possible to process contents according to contents utilizationrestrictions. The data processing apparatus selectively uses these twokeys according to contents utilization restrictions. For example, in thecase where the contents are only available to the data processingapparatus, the key specific to the data processing apparatus is used,while in the case where the contents are also available to othersystems, a check value for the contents data is generated and collationprocessing is performed using the system common key. It is possible todecrypt and reproduce the encrypted data only when the collation isestablished, thus allowing processing according to contents utilizationrestrictions such as contents only available to the data processingapparatus or contents commonly available to the system, etc.

Furthermore, the data processing apparatus, data processing method andcontents data verification value assignment method of the presentinvention is configured to generate a contents check value in units ofcontents block data, execute collation processing on the contents checkvalue generated, generate a contents intermediate value based on thecontents block data to be verified and generate a contents check valuethrough encryption processing applying a contents check value generationkey, thus allowing efficient verification compared to conventionalprocessing on entire data.

Furthermore, the data processing apparatus, data processing method andcontents data verification value assignment method of the presentinvention allows verification in contents block units and simplifiedverification processing according to download processing andreproduction processing, etc. providing efficient verification accordingto the mode of use.

Furthermore, since the data processing apparatus, the content datagenerating method, and the data processing method of the presentinvention is made to have the configuration that is provided with theplurality of content blocks in the content data and enables encryptionprocessing for a unit of each content block, and also have theconfiguration in which the key used for content encryption is furtherencrypted and stored in the header section, even if, for example, aplurality of content blocks exist and blocks requiring encryptionprocessing and blocks not requiring encryption processing are mixed, itbecomes possible to have an arbitrary data structure that couples eachblock.

In addition, according to the data processing apparatus, the dataprocessing system, and the data processing method of the presentinvention, by making the configuration of the content block to be aregular configuration, for example, a configuration having a uniformdata length, or a configuration in which the encryption block and thenon-encryption (plaintext) block are alternately disposed, decryptionprocessing and the like of the content block can be promptly executed,and encryption content data suitable for processing corresponding tocontents of the content data, for example, reproduction and the like ofmusic data can be provided.

Furthermore, the data processing apparatus, the data processing methodand the content data generating method can efficiently executereproduction processing in the case in which contents are compressedvoice data, image data or the like. That is, by making a configurationof content data to be one in which compressed data and an expansionprocessing program are combined, expansion processing, to which anexpansion processing program incidental to compressed content data isapplied, is made possible in the reproduction processing apparatus, anda situation in which the expansion processing program does not exist inthe reproduction processing apparatus and reproduction cannot beperformed can be avoided.

Moreover, according to the data processing apparatus, the dataprocessing method and the content data generating means, since aconfiguration of content data has a configuration in which thereproduction processing apparatus determines the expansion processingprogram applicable to the compressed content data based on the headerinformation, and the reproduction processing apparatus further retrievesa program applicable from accessible recording media or the like andexecutes expansion processing by making content data to be a combinationof compressed data and the header section storing the type of thecompression processing program, or, if the contents has the expansionprocessing program, a combination of the expansion processing programand the header storing the type of the program, program retrievingprocessing does not need to be executed by a user, and efficientreproduction processing becomes possible.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a view showing the configuration of a conventional dataprocessing system.

FIG. 2 is a view showing the configuration of a data processingapparatus to which the present invention is applied.

FIG. 3 is a view showing the configuration of a data processingapparatus to which the present invention is applied.

FIG. 4 is a view showing a data format of content data on a medium or acommunication path.

FIG. 5 is a view showing a usage policy contained in a header of contentdata.

FIG. 6 is a view showing block information contained in a header ofcontent data.

FIG. 7 is a view showing an electronic signature generating method usingDES.

FIG. 8 is a view showing an electronic signature generating method usingTriple DES.

FIG. 9 is a view depicting Triple DES.

FIG. 10 is a view showing an electronic signature generating methodpartly using Triple DES.

FIG. 11 is a view showing a process flow of electronic signaturegeneration.

FIG. 12 is a view showing a process flow of electronic signaturegeneration.

FIG. 13 is a view depicting a mutual authentication process sequenceusing a symmetrical cryptography technique.

FIG. 14 is a view depicting a public key certificate.

FIG. 15 is a view depicting a mutual authentication process sequenceusing an asymmetrical cryptography technique.

FIG. 16 is a view showing a process flow of an encryption process usingelliptic curve cryptography.

FIG. 17 is a view showing a process flow of a decryption process usingelliptic curve cryptography.

FIG. 18 is a view showing how data are held on a recording andreproducing device.

FIG. 19 is a view showing how data are held on a recording device.

FIG. 20 is a view showing a process flow of mutual authenticationbetween the recording and reproducing device and the recording device.

FIG. 21 is a view showing the relationship between a master key of therecording and reproducing device and a corresponding master key of therecording device.

FIG. 22 is a view showing a process flow of a content download process.

FIG. 23 is a view depicting a method for generating an integrity checkvalue A: ICVa.

FIG. 24 is a view depicting a method for generating an integrity checkvalue B: ICVb.

FIG. 25 is a view depicting a method for generating a total integritycheck value and an integrity check value unique to the recording andreproducing device.

FIG. 26 is a view showing a format of content data stored in therecording device (localization field=0).

FIG. 27 is a view showing a format of content data stored in therecording device (localization field=1).

FIG. 28 is a view showing a process flow of a content reproductionprocess.

FIG. 29 is a view depicting a method by which the recording deviceexecutes commands.

FIG. 30 is a view depicting a method by which the recording deviceexecutes commands in a content storage process.

FIG. 31 is a view depicting a method by which the recording deviceexecutes commands in a content reproduction process.

FIG. 32 is a view depicting the configuration of a content data formattype 0.

FIG. 33 is a view depicting the configuration of a content data formattype 1.

FIG. 34 is a view depicting the configuration of a content data formattype 2.

FIG. 35 is a view depicting the configuration of a content data formattype 3.

FIG. 36 is a view depicting a method for generating a content integritycheck value ICVi for the format type 0.

FIG. 37 is a view depicting a method for generating a content integritycheck value ICVi for the format type 1.

FIG. 38 is a view depicting a total integrity check value and anintegrity check value unique to the recording and reproducing device forthe format types 2 and 3.

FIG. 39 is a view showing a process for downloading content of theformat type 0 or 1.

FIG. 40 is a view showing a process for downloading content of theformat type 2.

FIG. 41 is a view showing a process for downloading content of theformat type 3.

FIG. 42 is a view showing a process for reproducing content of theformat type 0.

FIG. 43 is a view showing a process for reproducing content of theformat type 1.

FIG. 44 is a view showing a process for reproducing content of theformat type 2.

FIG. 45 is a view showing a process for reproducing content of theformat type 3.

FIG. 46 is a view (1) depicting a method by which a content generatorand a content verifier generate integrity check values and executeverification using them.

FIG. 47 is a view (2) depicting a method by which the content generatorand the content verifier generate integrity check values and executeverification using them.

FIG. 48 is a view (3) depicting a method by which the content generatorand the content verifier generate integrity check values and executeverification using them.

FIG. 49 is a view depicting a method for individually generating variouskeys using master keys.

FIG. 50 is a view (example 1) showing an example of a process executedby a content provider and a user in conjunction with the method forindividually generating various keys using master keys.

FIG. 51 is a view (example 2) showing an example of a process executedby the content provider and the user in conjunction with the method forindividually generating various keys using master keys.

FIG. 52 is a view illustrating a configuration for executinglocalization using different master keys.

FIG. 53 is a view (example 3) showing an example of a process executedby the content provider and the user in conjunction with the method forindividually generating various keys using master keys.

FIG. 54 is a view (example 4) showing an example of a process executedby the content provider and the user in conjunction with the method forindividually generating various keys using master keys.

FIG. 55 is a view (example 5) showing an example of a process executedby the content provider and the user in conjunction with the method forindividually generating various keys using master keys.

FIG. 56 is a view showing a flow of a process for storing a cryptographykey with Triple DES applied thereto, using the Single DES algorithm.

FIG. 57 is a view showing a content reproduction process flow(example 1) based on priority.

FIG. 58 is a view showing a content reproduction process flow (example2) based on priority.

FIG. 59 is a view showing a content reproduction process flow (example3) based on priority.

FIG. 60 is a view illustrating a configuration for executing a processfor decrypting (decompressing) compressed data during the contentreproduction process.

FIG. 61 is a view showing an example of the configuration of content(example 1).

FIG. 62 is a view showing a reproduction process flow in the example 1of the configuration of the content.

FIG. 63 is a view showing an example of the configuration of content(example 2).

FIG. 64 is a view showing a reproduction process flow in the example 2of the configuration of the content.

FIG. 65 is a view showing an example of the configuration of content(example 3).

FIG. 66 is a view showing a reproduction process flow in the example 3of the configuration of the content.

FIG. 67 is a view showing an example of the configuration of content(example 4).

FIG. 68 is a view showing a reproduction process flow in the example 4of the configuration of the content.

FIG. 69 is a view illustrating a process for generating and storing savedata.

FIG. 70 is a view showing a process flow for an example (example 1) ofthe process for storing saved data.

FIG. 71 is a view showing the configuration of a data managing file(example 1) used during a process for storing and reproducing save data.

FIG. 72 is a view showing a process flow for an example (example 1) ofthe process for reproducing save data.

FIG. 73 is a view showing a process flow for an example (example 2) ofthe process for storing save data.

FIG. 74 is a view showing a process flow for an example (example 2) ofthe process for reproducing save data.

FIG. 75 is a view showing a process flow for an example (example 3) ofthe process for storing save data.

FIG. 76 is a view showing the configuration of a data managing file(example 2) used during the process for storing and reproducing savedata.

FIG. 77 is a view showing a process flow for an example (example 3) ofthe process for reproducing save data.

FIG. 78 is a view showing a process flow for an example (example 4) ofthe process for storing save data.

FIG. 79 is a view showing a process flow for an example (example 4) ofthe process for reproducing save data.

FIG. 80 is a view showing a process flow for an example (example 5) ofthe process for storing save data.

FIG. 81 is a view showing the configuration of a data managing file(example 3) used during the process for storing and reproducing savedata.

FIG. 82 is a view showing a process flow for an example (example 5) ofthe process for reproducing save data.

FIG. 83 is a view showing a process flow for an example (example 6) ofthe process for storing save data.

FIG. 84 is a view showing the configuration of a data managing file(example 4) used during the process for storing and reproducing savedata.

FIG. 85 is a view showing a process flow for an example (example 6) ofthe process for reproducing save data.

FIG. 86 is a view illustrating a configuration for excluding invalidcontent users (revocation).

FIG. 87 is a view showing a flow of a process (example 1) for excludinginvalid content users (revocation).

FIG. 88 is a view showing a flow of a process (example 2) for excludinginvalid content users (revocation).

FIG. 89 is a view illustrating a configuration of the security chip(example 1).

FIG. 90 is a view showing a process flow for a method for manufacturinga security chip.

FIG. 91 is a view illustrating the configuration of the security chip(example 2).

FIG. 92 is a view showing a flow of a process for writing data in thesecurity chip (example 2).

FIG. 93 is a view showing a flow of a process for checking written datain the security chip (example 2).

DETAILED DESCRIPTION

The embodiments of the present invention will be described below. Thedescription will proceed in the order of the following items:

(1) Configuration of Data Processing apparatus

(2) Content Data Format

(3) Outline of Cryptography Processes Applicable to Present DataProcessing Apparatus

(4) Configuration of Data Stored in Recording and Reproducing Apparatus

(5) Configuration of Data Stored in Recording Device

(6) Mutual Authentication Process between Recording and ReproducingDevice and Recording Device

(6-1) Outline of Mutual Authentication Process

(6-2) Switching to Key Block during Mutual Authentication

(7) Process for Downloading from Recording and Reproducing Device toRecording Device

(8) Process Executed by Recording and Reproducing Device to ReproduceInformation from Recording Device

(9) Key Exchanging Process after Mutual Authentication

(10) Plural Content Data Formats and Download and Reproduction ProcessesCorresponding to Each Format

(11) Aspect of Process Executed by Content Provider to Generate CheckValues (ICV)

(12) Cryptography Process Key Generating Configuration Based on MasterKey

(13) Controlling Cryptography Intensity in Cryptography Process

(14) Program Activating Process Based on Activation Priority in HandlingPolicy in Content Data

(15) Content Configuration and Reproduction (Decompression) Process

(16) Process for Generating and storing Saved Data in Recording Deviceand Reproducing the Same therefrom

(17) Configuration for Excluding (Revoking) Illegal Apparatuses

(18) Secure Chip Configuration and Manufacturing Method therefor

(1) Configuration of Data Processing Apparatus

FIG. 2 illustrates a block diagram showing the general configuration ofone embodiment of a data processing apparatus according to the presentinvention. Main components of the data processing apparatus are arecording and reproducing device 300 and a recording device 400.

The recording and reproducing device 300 comprises, for example, apersonal computer (PC), a game apparatus or the like. The recording andreproducing device 300 has a control section 301 for carrying outunifying control including the control of communication between therecording and reproducing device 300 and the recording device 400 duringa cryptography process in the recording and reproducing device 300. Therecording and reproducing device 300 also includes a cryptographyprocess section 302, which is responsible for the whole cryptographyprocess. It also includes a recording device controller 303 forexecuting an authentication process with the recording device 400connected to the recording and reproducing device 300 to read and writedata. Recording and reproducing device 300 further includes a readsection 304 for reading data from a medium 500, such as a DVD, CD,floppy disk (FD) or hard disk (HDD), and a communication section 305 fortransmitting and receiving data to and from the exterior network viacommunication means 600.

The recording and reproducing device 300 downloads and reproducescontent data to and from the recording device 400 controlled by thecontrol section 301. The recording device 400 is a storage medium thatcan preferably be installed in and removed from the recording andreproducing device 300, for example, as a memory card. The recordingdevice 400 has an external memory 402 comprising a non-volatile memorysuch as an EEPROM, a flash memory, a hard disk, or a RAM with batteries.

The recording and reproducing device 300 has the read section 304 as aninterface to which content data stored in the storage medium 500. Thecommunication section 305 acts as an interface to which content datadistributed from an exterior network such as the Internet can be input.

The recording and reproducing device 300 has the cryptography processsection 302 to execute an authentication process, an encryption and adecryption processes, a data verification process, or other processes.The cryptography process section 302 operates in downloading contentdata externally input via the read section 304 or the communicationsection 305 to the recording device 400 or reproducing and executingcontent data from the recording device 400. The cryptography processsection 302 comprises a control section 306, an internal memory 307 andan encryption/decryption section 308. Control Section 306 controls theentire cryptography process section 302. The internal memory 307 holdsinformation such as keys for the cryptography process and which has beenprocessed so as to prevent data from being externally read out therefromeasily. Encryption/decryption section 308 is used for executing theencryption and decryption processes, generating and verifyingauthentication data, generating random numbers, etc.

The control section 301 transmits an initialization command to therecording device 400 via the recording device controller 303 when, forexample, the recording device 400 is installed in the recording andreproducing device 300. Control section 301 can also execute a mediationprocess for various processes such as a mutual authentication betweenthe encryption/decryption section 308 and the encryption/decryptionsection 406. Control section 301 can also perform an integrity checkvalue collating process and encryption and decryption processes. Each ofthese processes will be described in detail later.

The cryptography process section 302 can execute the authenticationprocess, the encryption and decryption processes, the data verifyingprocess, and other processes, as previously described.

The cryptography process control section 306 executes control of thewhole cryptography process. This includes the authentication process andthe encryption/decryption processes executed by the recording andreproducing device 300. These are, for example, processes of setting anauthentication completion flag when the authentication process executedbetween the recording and reproducing device 300 and the recordingdevice 400 has completed and commanding the execution of variousprocesses executed in the encryption/decryption section 308. Some of thevarious processes are, for example, a download process, a process forgenerating integrity check values for reproduced content data, andcommanding the execution of a process for generating various key data.

The internal memory 307 stores key data, identification data, and otherdata required for various processes. Some of the various processesinclude the mutual authentication process, the integrity check valuecollating process, and the encryption and decryption processes which areexecuted in the recording and reproducing device 300. These processeswill be described later in detail.

The encryption/decryption section 308 uses key data and similarinformation stored in the internal memory 307 to execute theauthentication process, the encryption and decryption processes, thegeneration and verification of predetermined integrity check values orelectronic signatures, the verification of data, the generation ofrandom numbers, etc. in downloading externally input content data to therecording device 400 or reproducing and executing content data stored inthe recording device 400.

In this case, the internal memory 307 of the recording and reproducingdevice cryptography process section 302 holds important information suchas cryptography keys and is configured so as not to have its dataexternally read out easily. Thus, the cryptography process section 306is configured as a tamper-resistant memory characterized to restrainexternal invalid reads. It comprises, for example, a semiconductor chipthat essentially rejects external accesses and has a multilayerstructure, an internal memory sandwiched between dummy layers ofaluminum or the like or arranged in the lowest layer, and a narrow rangeof operating voltages and/or frequencies. This configuration will bedescribed later in detail.

In addition to these cryptography process functions, the recording andreproducing device 300 comprises a main Central Processing Unit (CPU)106, a RAM (Random Access Memory) 107, a ROM (Read Only Memory) 108, anAV process section 109, an input interface (I/F) 110, a PIO (ParallelI/O) interface 111, and a SIO (Serial I/O) interface 112.

The main CPU 106, the RAM 107, and the ROM 108 are componentsfunctioning as a control system for the main body of the recording andreproducing device 300. CPU 106, RAM 107 and ROM 103 principallyfunction as a reproduction process section for reproducing datadecrypted by the cryptography process section 302. For example, the mainCPU 106 executes control for the reproduction and execution of content,such as output of content data read out from the recording device andthen decrypted, to the AV process section 109 under the control of thecontrol section 301.

The RAM 107 is used as a main storage memory for various processesexecuted by the CPU 106 and as a working area for these processes. TheROM 108 stores a basic program for starting up an Operating System (OS)or the like activated by the CPU 106, as well as other data.

The AV process section 109 has a data compression and decompressionprocess mechanism. Specifically, the AV process section 109 includes anMPEG2 decoder, an ATRAC decoder, an MP3 decoder etc . . . to executeprocesses for data outputs to a data output apparatus such as a displayor speakers (not shown) attached or connected to the recording andreproducing device 300 main body.

The input I/F 110 outputs data input from various connected input meanssuch as a controller, a keyboard, and a mouse, to the main CPU 106. Themain CPU 106 executes a process in accordance with a command issued by auser via the controller, based on, for example, a game program beingexecuted.

The PIO interface 111 and the SIO interface 112 are used as storagedevices for a memory card or a game cartridge and as a connectioninterface to a portable electronic device or the like.

The main CPU 106 also executes control in storing saved data, settingdata or the like for, as an example, a game being executed. During thisprocess, stored data is transferred to the control section 301. Thiscauses the cryptography process section 302 to execute a cryptographyprocess for the saved data as required and then stores the encrypteddata in the recording device 400. These cryptography processes will bedescribed later in detail.

The recording device 400 is a storage medium that can preferably beinstalled in and removed from the recording and reproducing device 300,and comprises, for example, a memory card. The recording device 400 hasthe cryptography process section 401 and the external memory 402.

The recording device cryptography process section 401 executes themutual authentication process, encryption and decryption processes, dataverification process, and other processes. These processes occur betweenthe recording and reproducing device 300 and the recording device 400 indownloading content data from the recording and reproducing device 300or reproducing content data from the recording device 400 to therecording and reproducing device 300. The cryptography process section401 has a control section, an internal memory, an encryption/decryptionsection, and other components similar to the cryptography processsection of the recording and reproducing device 300. The details will bedescribed in relation to FIG. 3. The external memory 402 storesencrypted content data or the like. It comprises a non-volatile memorycomprising a flash memory such as an EEPROM, a hard disk, a RAM withbatteries or the like.

FIG. 3 is a view schematically showing the configuration of data inputfrom the medium 500 and the communication means 600 that are contentproviding means from which the data processing apparatus according tothe present invention receives data. The recording and reproducingdevice 300 receives an input of content from the content providing means500 or 600. Recording and reproducing device 300 operates onarrangements for the cryptography process in the recording device 400.

The medium 500 is, for example, an optical disk medium, a magnetic diskmedium, a magnetic tape medium, a semiconductor medium, or the like. Thecommunication means 600 is capable of data communication via theInternet, cable, or satellite communication.

In FIG. 3, the recording and reproducing device 300 verifies data inputby the medium 500 or the communication means 600. That is, a recordingand reproducing device 300 verifies content meeting a predeterminedformat, and stores the verified content in the recording device 400.

As shown in the sections of the medium 500 and communication means 600the content data has the following components:

Content ID: content ID as an identifier for content data.

Usage policy: a usage policy containing constituent information ofcontent data. For example, the usage policy contains the sizes of aheader section and a content section constituting the content data, aformat version, a content type indicating whether the content is aprogram or data, and a localization field indicating whether the contentcan be used only in an apparatus that has downloaded the content or alsoin other apparatuses.

Block information table: the block information table comprises thenumber of content blocks, a block size, an encryption flag indicatingthe presence of encryption, and other information.

Key data: key data comprises an encryption key for encrypting the abovedescribed block information table, a content key for encrypting acontent block, or the like.

Content block: the content block comprises program data, music or imagedata, or other data to be actually reproduced.

The content data will be explained later in further detail withreference to FIG. 4 and subsequent figures.

The content data are encrypted by the content key (hereafter referred toas the “Knon”) and then provided to the recording and reproducing device300 from the medium 500 or the communication means 600. The content canbe stored in the external memory of the recording device 400 via therecording and reproducing device 300.

For example, the recording device 400 uses a key (hereafter referred toas a “storage key”, or Kstr unique thereto. The storage key is stored inthe internal memory 405 thereof to encrypt the content contained in thecontent data, the block information table contained in the content dataas header information, and information on various keys, such as thecontent key Kcon. This is done before storing these data in the externalmemory 402. To download the content data from the recording andreproducing device 300 to the recording device 400 or allow therecording and reproducing device 300 to reproduce the content datastored in the recording device 400, predetermined procedures such as amutual authentication process between the apparatuses and content dataencrypting and decrypting processes are required. These processes willbe explained later in detail.

The recording device 400 has the cryptography process section 401 andthe external memory 402. The cryptography process section 401 has acontrol section 403, a communication section 404, the internal memory405, an encryption/decryption section 406, and an external memorycontrol section 407.

The recording device 400 is responsible for the whole cryptographyprocess, controls the external memory 402, and comprises the recordingdevice cryptography process section 401 cryptography process section 401is for interpreting a command from the recording and reproducing device300 and executing a process. The recording device 400 also includes theexternal memory 402, which holds contents or the like.

The recording device cryptography process section 401 has the controlsection 403 for controlling the entire recording device cryptographyprocess section 401, the communication section 404 for transmitting andreceiving data to and from the recording and reproducing device 300 andthe internal memory 405. Internal memory 405 holds information such askeys for the cryptography process. The information has been processed soas to prevent data from being easily externally read out therefrom. Theencryption/decryption section 406 is used for executing the encryptionand decryption processes, generating and verifying authentication data,generating random numbers, etc. The external memory control section 407is used for reading and writing data from and to the external memory402.

The control section 403 executes control of the whole cryptographyprocess. This includes the authentication process and theencryption/decryption processes executed by the recording device 400.The encryption/decryption processes include, for example, processes ofsetting an authentication completion flag when the authenticationprocess executed between the recording and reproducing device 300 andthe recording device 400 has completed. The control section 403 alsocommands the execution of various processes executed in theencryption/decryption section 406 of the cryptography process section401. For example, the various processes can include a download processand a process for generating integrity check values for reproducedcontent data. The control section 403 also commands the execution of aprocess for generating various key data.

The internal memory 405 comprises a memory having a plurality of blocksto store a plurality of sets of key data, identification data, or otherdata which are required for various processes. Such various processesinclude the mutual authentication process, integrity check valuecollating process, and an encryption and decryption process, which areexecuted by the recording device 400, as described later in detail.

The internal memory 405 of the recording device cryptography processsection 401, like the internal memory 307 of the cryptography processsection 302 previously described, holds important information such ascryptography keys. Internal memory 307 must thus be configured so as notto have its data externally read out easily. Thus, the cryptographyprocess section 401 of the recording device 400 is characterized torestrain external invalid reads. It comprises a semiconductor chip thatessentially rejects external accesses and has a multilayer structure, aninternal memory sandwiched between dummy layers of aluminum or the likeor arranged in the lowest layer, and a narrow range of operatingvoltages and/or frequencies. In this regard, the cryptography processsection 302 may be software configured so as to prevent secretinformation for keys from leaking easily to the exterior network or thelike.

The encryption/decryption section 406 uses key data or the like storedin the internal memory 405 to execute the data verifying process, theencryption and decryption processes, the generation and verification ofpredetermined integrity check values or electronic signatures, thegeneration of random numbers, etc. It does this in downloading contentdata from the recording and reproducing device 300, reproducing contentdata stored in the external memory 402 of the recording device 400, orexecuting mutual authentication between the recording and reproducingdevice 300 and the recording device 400.

The communication section 404 is connected to the recording devicecontroller 303 of the recording and reproducing device 300. Thecommunication section 404 downloads or reproduces content data orcommunicates transfer data between the recording and reproducing device300 and the recording device 400 during the mutual authenticationprocess. This is done according to the control of the control section301 of the recording and reproducing device 300, or the control of thecontrol section 403 of the recording device 400.

(2) Content Data Format

Next, by using FIG. 4 to FIG. 6, the data format of data stored in themedium 500 or communicated on the data communication means 600 will beexplained.

The configuration shown in FIG. 4 shows the format of the entire contentdata. The configuration shown in FIG. 5 shows details of the “usagepolicy” that partly constitutes the header section of the content data.The configuration shown in FIG. 6 shows details of the “blockinformation table” that partly constitutes the header section of thecontent.

A representative example of the data format applied to the systemaccording to the present invention will be explained. However, differenttypes of data formats, such as formats corresponding to game programsand formats suitable for real-time processing of music data or the like,can be used for the present system. The aspects of these formats will bedescribed later in further detail in “(10) Plural Content Data Formatsand Download and Reproduction Processes Corresponding to Each Format.”

In the data format shown in FIG. 4, items shown in gray indicateencrypted data. Items enclosed by double frames indicate tamper checkdata. The other items shown in white indicate plain text data that arenot encrypted. Encryption keys of the encryption section are shown onthe left of the frames. In the example shown in FIG. 4, some of theblocks (content block data) of the content section contain encrypteddata, while the others contain non-encrypted data. This form variesdepending on the content data. All the content block data contained inthe data may be encrypted.

As shown in FIG. 4, the data format is divided into the header sectionand the content section. The header section comprises a content ID, ausage policy, an integrity check value A (hereafter referred to as“ICVa”), a block information table key (hereafter referred to as“Kbit”), a content key Kcon, a block information table (hereafterreferred to as “BIT”), an integrity check value B (“ICVb”), and a totalintegrity check value (“ICVt”). The content section comprises aplurality of content blocks, for example, encrypted and non-encryptedcontent.

In this case, the individual information indicates a content ID foridentifying a specific piece of content. The usage policy, as shown inFIG. 5, comprises a header length indicating the size of the headersection; a content length indicating the size of the content section; aformat version indicating version information for the format; a formattype indicating the type of the format; a content type indicating thetype of the content, that is, whether it is a program or data; anoperation priority indicating a priority for activation if the contenttype is a program; a localization field indicating whether the contentdownloaded in accordance with this format can be used only in anapparatus that has downloaded the content or also in other similarapparatuses; a copy permission indicating whether the content downloadedin accordance with this format can be copied from the apparatus that hasdownloaded the content to another similar apparatus; a move permissionindicating whether the content downloaded in accordance with this formatcan be moved from the apparatus that has downloaded the content toanother similar apparatus; an encryption algorithm indicating analgorithm used to encrypt content blocks in the content section; anencryption mode indicating a method for operating the algorithm used toencrypt the content in the content section; and an integrity checkmethod indicating a method for generating integrity check values, asshown in detail in FIG. 5.

The above described data items recorded in the usage policy are onlyexemplary and various usage policy information can be recorded dependingon the aspect of corresponding content data. The identifier is describedlater in detail in, for example, “(17) Configuration for Excluding(Revoking) Illegal Apparatuses.” It is also possible to make aconfiguration so as to exclude the use of content caused by the illegalapparatus by recording the content of an illegal recording andreproducing apparatus as data and by checking the start time of the use.

The integrity check value A ICVa is used to verify that the content IDor the usage policy has not been tampered with. It functions as a checkvalue for partial data instead of the entire content data. That is, itfunctions as a partial integrity check value. The data block informationtable key Kbit is used to encrypt a block information table. The contentkey Kcon is used to encrypt content blocks. The block information tablekey Kbit and the content key Kcon are encrypted with a distribution key(hereafter referred to as “Kdis”) on the medium 500 and thecommunication means 600.

FIG. 6 shows the block information table in detail. The blockinformation table in FIG. 6 comprises data encrypted with the blockinformation table key Kbit as illustrated in FIG. 4. The blockinformation table comprises a block number, indicating the number ofcontent blocks and information on N content blocks. The content blockinformation table comprises a block length; an encryption flagindicating whether or not the block ash been encrypted; an ICV flagindicating whether or not integrity check values must be calculated, anda content integrity check value (ICVi).

The content integrity check value is used to verify that each contentblock has not been tampered with. A specific example of a method forgenerating a content integrity check value will be explained later in“(10) Plural Content Data Formats and Download and ReproductionProcesses Corresponding to Each Format.” The block information table keyKbit, used to encrypt the block information table, is further encryptedwith the distribution key Kdis.

The data format in FIG. 4 will be described further. The integrity checkvalue B, ICVb, is used to verify that the block information table keyKbit, the content key Kcon, and the block information table have notbeen tampered with. It functions as a check value for partial datainstead of the entire content data. That is, it functions as a partialintegrity check value. The total integrity check value ICVt is used toverify the integrity check values ICVa and ICVb, integrity check valuesICVi for each content block (if this has been set), partial integritycheck values thereof, or all the data to be checked have not beentampered with.

In FIG. 6, the block length, the encryption flag, and the ICV flag canbe arbitrarily set. However, certain rules may be established. Forexample, encrypted and plain-text areas may be repeated over a fixedlength, all the content data may be encrypted, or the block informationtable BIT may be compressed. Additionally, the content key Kcon may becontained in the content block instead of the header section to allowdifferent content keys Kcon to be used for different content blocks.Examples of the content data format will be described in further detailin (10) Plural Content Data Formats and Download and ReproductionProcesses Corresponding to Each Format.”

(3) Outline of Cryptography Processes Applicable to Present DataProcessing Apparatus

Next, the aspects of various cryptography processes applicable to thedata processing apparatus according to the present invention will beexplained. The description of the cryptography processes shown in “(3)Outline of Cryptography Processes Applicable to Present Data ProcessingApparatus” correspond to an outline of the aspect of a cryptographyprocess on which are based various processes executed by the presentdata processing apparatus, which will be specifically described later.For example, “a. authentication process between recording andreproducing device and recording device”, “b. download process fordevice for loading contents”, and “c. process for reproducing contentstored in recording device” will be explained herein. Specific processesexecuted by the recording and reproducing device 300 and the recordingdevice 400 will be each described in detail in item (4) and subsequentitems.

An outline of the cryptography process applicable to the data processingapparatus will be described in the following order:

(3-1) Message Authentication Based on Common Key Cryptosystem

(3-2) Electronic Signature Based on Public Key Cryptosystem

(3-3) Verification of Electronic Signature Based on Public KeyCryptosystem

(3-4) Mutual Authentication Based on Common Key Cryptosystem

(3-5) Public Key Certificate

(3-6) Mutual Authentication Based on Public Key Cryptosystem

(3-7) Encryption Process Using Elliptic Curve Cryptography

(3-8) Decryption Process Using Elliptic Curve Cryptography

(3-9) Random Number Generating Process

(3-1) Message Authentication Based on Common Key Cryptosystem

First, a process for generating tamper detecting data using a common keycryptography method will be explained. The tamper detecting data areadded to the data in order to check for tampering and to authenticate acreator.

For example, the tamper detecting data may be the ICVa, the ICVb, andthe total integrity check value in the data structure described in FIG.4, and the content check value stored in each block in the blockinformation table shown in FIG. 6.

Here, the use of the DES, which is a common key cryptosystem, will beexplained as an example of a method for generating and processingelectronic signature data. In addition to the DES, the present inventionmay use, for example, the FEAL (Fast Encipherment Algorithm or the AES(Advance Encryption Standard) (U.S. next-term standard cryptography) asa similar process based on a common key cryptosystem.

A method for generating an electronic signature using a general DES willbe explained with reference to FIG. 7. First, before generating anelectronic signature, a message to which the electronic signature is tobe added is divided into sets of 8 bytes (the pieces of the dividedmessage are hereafter referred to as “M1, M2, . . . , MN”). An initialvalue (hereafter referred to as “IV”) and the M1 are exclusive-ORed. Theresult is referred to as “I1”. Next, the I1 is input to a DES encryptingsection, which encrypts it using a key (hereafter referred to as “K1”)The output is referred to as “E1”. Subsequently, the E1 and the M2 areexclusive-ORed, and the output I2 is input to the DES encryptingsection, which encrypts it using the key K1 the output is referred to as“E2”. This process is repeated to encrypt all the messages (M1, M2, . .. MN) obtained by means of the division. The final output is anelectronic signature (“EN”). This value is generally called a “MAC(Message Authentication Code)” used to check a message for tampering. Inaddition, such a system for chaining encrypted texts is called a “CBC(Cipher Block Chaining) mode.”

The MAC value output in the example of generation shown in FIG. 7 can beused as the integrity check value A or B or total integrity check valuein the data structure shown in FIG. 4 which is enclosed by double framesand the content check value ICV1 to ICVN stored in each block in theblock information table shown in FIG. 6. In verifying the MAC value, averifier generates it using a method similar to that used to originallygenerate it. The verification is determined to be successful if the samevalue is obtained.

Moreover, in the example shown in FIG. 7, the initial value IV isexclusive-ORed with the first 8-byte message M1, but the initial valueIV may be zero and not exclusive-ORed.

FIG. 8 shows the configuration of a method for generating the MAC valuewhich has improved security compared to the MAC value generating methodshown in FIG. 7. FIG. 8 shows an example where instead of the Single DESin FIG. 7, the Triple DES is used to generate the MAC value.

FIGS. 9A and 9B show an example of a detailed configuration of each ofthe Triple DES components shown in FIG. 8. There are two differentaspects of the configuration of the Triple DES as shown in FIG. 9. FIG.9( a) shows an example using two cryptography keys. Processing iscarried out in the order of an encryption process with a key 1 (K1), adecryption process with a key 2 (K2), and an encryption process with thekey 1. The two types of keys are used in the order of K1, K2, and K1.FIG. 9( b) shows an example using three cryptography keys. Processing iscarried out in the order of an encryption process with the key 1, anencryption process with the key 2, and an encryption process with a key3 (K3). The three types of keys are used in the order of K1, K2, and K3.The plurality of processes are thus continuously executed to improvesecurity intensity compared to the Single DES. The Tripled DESconfiguration, however, has the disadvantage of requiring an amount ofprocessing time three times as large as that for the Single DES.

FIG. 10 shows an example of a MAC value generating configurationobtained by improving the Triple DES configuration described in FIGS. 8and 9. In FIG. 10, the encryption process for each of the messages (M1,M2, . . . , MN) from beginning to end of a message string to which asignature is to be added is based on the Single DES. Only the encryptionprocess for the last message is based on the Triple DES configurationshown in FIG. 9( a).

The configuration shown in FIG. 10 reduces the time required to generatethe MAC value for the message down to a value almost equal to the timerequired for the MAC value generating process based on the Single DES.This is done with improved security compared to the MAC value based onthe Single DES. Moreover, the Triple DES configuration for the lastmessage may be as shown in FIG. 9( b).

(3-2) Electronic Signature Based on Public Key Cryptosystem

The method for generating electronic signature data (if the common keyencryption system) is used as the encryption system has been described.A method for generating electronic signature data will be described withreference to FIG. 11 for a common key cryptosystem being used as theencryption system. The process shown in FIG. 11 corresponds to a processflow generation of electronic signature data using the Elliptic CurveDigital Signature Algorithm (EC-DSA), as per IEEE P1363/D3. An exampleusing Elliptic Curve Cryptography (hereafter referred as “ECC”) aspublic key cryptography will be explained. In addition to ECC, the dataprocessing apparatus according to the present invention may use, forexample, RSA (Rivest, Shamir, Adleman; ANSI X9.31) cryptography, whichis a similar public cryptosystem.

Each step in FIG. 11 will be described. At step S1, the followingdefinitions are set reference symbol p denotes a characteristic.Reference symbols a and b denote coefficients of an elliptic curve(elliptic curve: y²=x³+ax+b). M denotes a message. G denotes a basepoint on the elliptic curve. Symbol r denotes the digit of G. Ks denotesa secret key (0<Ks<r). At step S2, a hash value for the message M iscalculated to obtain f=Hash(M).

Then, a method for determining a hash value using a hash function willbe explained. The hash function receives a message as an input,compresses it into data of a predetermined bit length, and outputs thecompressed data as a hash value. The hash value is characterized in thatit is difficult to predict an input from a hash value (output). Forinstance, when one bit of data input to the hash function changes, manybits of the hash value change. Thus, it is difficult to find differentinput data with the same hash value. The hash function employed may be,for example, MD4, MD5, SHA-1, or DES-CBC similar to that described inFIG. 7 or other figures. In this case, the MAC (corresponding to theintegrity check value ICV), which is the final output value, is the hashvalue.

Subsequently, at step S3, a random number u (0<u<r) is generated. Atstep S4 the base point G is multiplied by u to obtain coordinates V (Xv,Yv). An addition and a multiplication by two on the elliptic curve aredefined as follows:

If P=(Xa, Ya),Q=(Xb, Yb),R=(Xc, YC)=P+Q.

When P≠Q (addition),Xc=λ ² −Xa−XbYc=λx(Xa−Xc)−Yaλ=(Yb−Ya)/(Xb−Xa)

When P=Q (multiplication by two),Xc=λ ²−2XaYc=λx(Xa−Xc)−Yaλ=(3(Xa)² +a)/(2Ya)  (1)

These are used to multiply the point G by u. Although the calculationspeed is low, the most easy-to-understand calculation method is shownbelow. G, 2×G, 4×G, . . . is calculated, the u is binary-expanded, andcorresponding 2^(I)×G (value obtained by multiplying G by 2 i times) isadded to bits of 1 (i denotes a bit position as counted from an LSB).

At step S5, c=Xv mod r is calculated, and at step S6, is determinedwhether the result is zero. If the result is not zero, then at step S7,d=[(f+cKs)/u] mod r is calculated. At step S8, it is determined whetherd is zero. If d is not zero, then at step S9, c and d are output aselectronic signature data. When r is assumed to denote a length of 160bits, the electronic signature data have a length of 320 bits.

If c is 0 at step S6, the process returns to step S3 to regenerate a newrandom number. Similarly, if d is 0 at step S8, the process also returnsto step S3 to regenerate a new random number.

(3-3) Verification of Electronic Signature Based on Public KeyCryptosystem

Next, a method for verifying an electronic signature using the publickey cryptosystem will be described with reference to FIG. 12. At stepS11, the following definitions are set. Reference symbol M denotes amessage. Reference symbol p denotes a characteristic. Reference symbolsa and b denote elliptic curve coefficients (elliptic curve: y²=x³+ax+b).Reference symbol G denotes a base point on the elliptic curve. Referencesymbol r denotes the digit of G. Reference symbols G and Ks×G denotepublic keys (0<Ks<r). At step S12, it is verified that the electronicsignature data c and d meet 0<c<r and 0<d<r. If the data meet theseconditions, then at step S13, a hash value for the message M iscalculated to obtain f=Hash (M). Next, at step S14, h=1/d mod r iscalculated, and at step S15, h1=fh mod r and h2=ch mod r are calculated.

At step S16, the already calculated values h1 and h2 are used tocalculate P=(Xp, Yp)=h1×G+h2·Ks×G. An electronic-signature verifierknows the public keys G and Ks×G and can thus calculate a scalarmultiplication of a point on the elliptic curve similar to step S4 inFIG. 11. Then, at step S17, it is determined whether the P is a point atinfinity. If not, the process proceeds to step S18 (the determination ofwhether the P is a point at infinity can actually be made at step S16).That is, when P=(X, Y) and Q=(X, −Y) are added together, if the λ cannotbe calculated, it indicates that P+Q is a point at infinity. At stepS18, Xp mod r is calculated and compared with the electronic signaturedata c. Finally, if these values are equal, the process proceeds to stepS19 to determine that the electronic signature is correct.

If it is determined that the electronic signature is correct, the datahas not been tampered with and a person holding the secret keycorresponding to the public keys has generated the electronic signature.

If the signature data c or d do not meet 0<c<r or 0<d<r at step S12, theprocess proceeds to step S20. Additionally, if the P is a point atinfinity at step S17, the process also proceeds to step S20. Further, ifthe value of Xp mod r does not equal the signature data c at step S18,the process proceeds to step S20.

If it is determined at step S20 that the signature is incorrect, thisindicates that the received data has been tampered with or has not beengenerated by the person holding the secret key corresponding to thepublic keys.

(3-4) Mutual Authentication Based on Common Key Cryptosystem

Next, a mutual authentication method using a common key cryptosystemwill be explained with reference to FIG. 13. In this figure, the commonkey cryptosystem is the DES, but any common key cryptosystem similar tothat previously described may be used. In FIG. 13, B first generates a64-bit random number Rb and transmits the Rb and its own ID, ID(b), toA. On receiving data, the A generates a new 64-bit random number Ra,encrypts the data in the DES CBC mode in the order of the Ra, Rb, andID(b) using a key Kab, and returns them to B. According to the DES CBCmode process configuration shown in FIG. 7, the Ra, Rb, and ID(b)correspond to M1, M2, and M3, and outputs E1, E2, and E3 are encryptedtexts when an initial value: IV=0.

On receiving the data, B decrypts the received data with the key Kab. Todecrypt the received data, the encrypted text E1 is first decrypted withthe key Kab to obtain the random number Ra. Then, the encrypted text E2is decrypted with the key Kab, and the result and E1 are exclusive-ORedto obtain the Rb. Finally, the encrypted text E3 is decrypted with thekey Kab, and the result and E2 are exclusive-ORed to obtain the ID(b).Of the Ra, Rb, and ID(b) thus obtained, the Rb and ID(b) are checked forequality to those transmitted by B. If they are successfully verified, Bauthenticates A.

Then, B generates a session key (hereafter referred to as “Kses”) usedafter the authentication. Kses is generated using a random number. TheRb, Ra, and Kses are encrypted in the DES CBC mode in this order usingthe key Kab and then returned to A.

On receiving the data, A decrypts the received data with the key Kab.The method for decrypting the received data is similar to that executedby B, so detailed description thereof is omitted. Of the Rb, Ra, andKses thus obtained, the Rb and Ra are checked for equality to thosetransmitted by A. If they are successfully verified, A authenticates B.After A and B have authenticated each other, the session key Kses isused as a common key for secret communication after the authentication.

If illegality or inequality is found during the verification of thereceived data, the mutual authentication is considered to have failedand the process is aborted.

(3-5) Public Key Certificate

Next, the public key certificate will be explained with reference toFIG. 14. The public key certificate is issued, for example, by aCertificate Authority (“CA”) for the public key cryptosystem. When auser submits his or her own ID, a public key, and others to the CA, theCA adds information such as its own ID and valid term to the datasubmitted by the user and further adds its signature thereto to generatea public key certificate.

The public key certificate shown in FIG. 14 contains the version numberof the certificate, the sequential number of the certificate allotted tothe certificate user by the CA, an algorithm and parameters used for theelectronic signature, the name of the CA, the valid term of thecertificate, the name (user ID) of the certificate user, and the publickey and electronic signature of the certificate user.

The electronic signature is data generated by applying the hash functionto the entirety of: the version number of the certificate, thesequential number of the certificate allotted to the certificate user bythe certificate authority; the algorithm and parameter used for theelectronic signature; the name of the CA; the valid term of thecertificate; the name of the certificate user; and the public key of thecertificate user. This generates a hash value. The secret key of the CAis used for this value. For example, the process flow described in FIG.11 is applied to the generation of the electronic signature.

The CA issues the public key certificate shown in FIG. 14, updates apublic key certificate for which the valid term has expired, andcreates, manages, and distributes an illegal user list to exclude userswho has committed an injustice (this is called “revocation”). It alsogenerates public and secret keys as required.

On the other hand, to use this public key certificate, the user uses thepublic key of the CA held by itself to verify the electronic signatureon the public key certificate. After the electronic signature has beensuccessfully verified, the user takes the public key out from the publickey certificate and uses it. Thus, all users who use the public keycertificate must hold a common public key of the CA. The method forverifying the electronic authority has been described in FIG. 12, sodetailed description thereof is omitted.

(3-6) Mutual Authentication Based on Public Key Cryptosystem

Next, a method for mutual authentication using a 160-bit elliptic curvecryptography, which is a public key cryptography, will be described withreference to FIG. 15. In this figure, the public key cryptosystem is theECC, but any similar public key cryptosystem may be used as previouslydescribed. In addition, the key size is not limited to 160 bits. In FIG.15, B first generates and transmits the 64-bit random number Rb to A. Onreceiving the data, A generates a new 64-bit random number Ra and arandom number Ak smaller than the characteristic p. It then multiplies abase point G by Ak to determine a point Av=Ak×G, generates an electronicsignature A. Sig for the Ra, Rb, and Av (X and Y coordinates), andreturns these data to B together with A's public key certificate. Inthis case, since the Ra and Rb each contain 64 bits and the X and Ycoordinates of the Av each contain 160 bits, the electronic signature isfor the total of 448 bits. The method for generating the electronicsignature has been described in FIG. 11, so detailed description thereofis omitted. The public key certificate has also been explained in FIG.14, so detailed description thereof is omitted.

On receiving A's public key certificate, Ra, Rb, Av, and electronicsignature A. Sig, B verifies that the Rb transmitted by A matches thatgenerated by the B. If they are determined to match, B verifies theelectronic signature in A's public key certificate using the public keyof the CA, and takes out A's public key. The verification of the publickey certificate has been explained with reference to FIG. 14, sodetailed description thereof is omitted. B then uses A's public keyobtained to verify the electronic signature A. Sig. The method forverifying the electronic signature has been explained in FIG. 12, sodetailed description thereof is omitted. Once the electronic signaturehas been successfully verified, B authenticates A.

Next, B generates a new random number Bk smaller than the characteristicp. It then multiplies the base point G by Bk to determine a pointBv=Bk×G, generates an electronic signature B. Sig for the Rb, Ra, and Bv(X and Y coordinates), and returns these data to A together with B'spublic key certificate.

On receiving B's public key certificate, Rb, Ra, Av, and electronicsignature B. Sig, A verifies that the Ra transmitted by B matches thatgenerated by A. If they match, A verifies the electronic signature inB's public key certificate using the public key of the CA, and takes outB's public key. A then uses B's public key obtained to verify theelectronic signature B. Sig. Once the electronic signature has beensuccessfully verified, A authenticates B.

If both A and B have successfully authenticated each other, B calculatesBk×Av (since the Bk is a random number but the Av is a point on theelliptic curve, the point on the elliptic curve must be subjected toscalar multiplication), and A calculates Ak×Bv so that lower 64 bits ofeach of the X coordinates of these points are used as the session keyfor subsequent communication (if the common key cryptography uses a64-bit key length). Of course, the session key may be generated from theY coordinates, or the lower 64 bits may not be used. In secretcommunication after the mutual authentication, not only transmitted dataare encrypted with the session key, but an electronic signature may beadded thereto.

If illegality or inequality is found during the verification of theelectronic signature or received data, the mutual authentication isconsidered to have failed and the process is aborted.

(3-7) Encryption Process Using Elliptic Curve Cryptography

Next, encryption using elliptic curve cryptography will be explainedwith reference to FIG. 16. At step S21, the following definitions areset. Reference symbols Mx and My denote messages. Reference symbol pdenotes a characteristic, reference symbols a and b denote ellipticcurve coefficients (elliptic curve: y²=x³+ax+b). Reference symbol Gdenotes a base point on the elliptic curve. Reference symbol r denotesthe digit of G. Reference symbols G and Ks×G denote public keys(0<Ks<r). At step S22, the random number u is generated so that 0<u<r.At step S23, coordinates V are calculated by multiplying the public keyKs×G by the u. The scalar multiplication on the elliptic curve has beenexplained at step S4 in FIG. 11, and description thereof is thusomitted. At step S24, the X coordinate of the V is multiplied by the Mxand then divided by the p to determine a remainder X0. At step S25, theY coordinate of the V is multiplied by the My and then divided by the pto determine a remainder Y0. If the length of the message is smallerthan the number of the bits, the My comprises a random number, and thedecryption section discards it. At step S26, u×G is calculated and atstep S27, an encrypted text u×G, (X0, Y0) is obtained.

Decryption Process Using Elliptic Curve Cryptography

Next, decryption using the elliptic curve cryptography will be describedwith reference to FIG. 17. At step S31, the following definitions areset. Reference symbols u×G and (X0, Y0) denote encrypted text data.Reference symbol p denotes a characteristic. Reference symbols a and bdenote elliptic curve coefficients (elliptic curve: y²=x³+ax+b).Reference symbol G denotes a base point on the elliptic curve. Referencesymbol r denotes the digit of G. Reference symbol Ks denotes a secretkey (0<Ks<r). At step S32, the encrypted data u×G are multiplied by avalue corresponding to the secret key Ks to determine coordinates V (Xv,Yv). At step S33, the X coordinate of (X0, Y0) is taken out from theencrypted data and X1=X0/Xv mod p is calculated. At step S34, the Ycoordinate is taken out and Y1=Y0/Yv mod p is calculated. At step S35,X1 is determined to be Mx and Y1 is determined to be My to obtain amessage. At this point, if the My is not used for the message, Y1 isdiscarded.

In this manner, when the secret key is Ks, the public key is G, and Ks×Gis calculated, the key used for encryption and the key used fordecryption may be different.

Another known example of the public key cryptography is the RSA, butdetailed description thereof is omitted (details thereof are describedin PKCS #1 Version 2).

Random Number Generating Process

Next, a method for generating a random number will be explained. Knownrandom-number generating methods include an intrinsic random-numbergenerating method that amplifies thermal noise to generate a randomnumber from the resulting A/D output and a pseudo random-numbergenerating method that combines together a plurality of linear circuitssuch as M sequences. A method is also known which uses common keycryptography such as the DES. In this example, the pseudo random-numbergenerating method using the DES will be described (ANSI X9.17 base).

First, the value of 64 bits (for a smaller number of bits, higher bitsare set to 0) obtained from data such as time is defined as D, keyinformation used for the Triple-DES is defined as Kr, and a seed forgenerating a random number is defined as S. Then, the random number R iscalculated as follows:I=Triple−DES(Kr,D)  (2-1)I=Triple−DES(Kr,S ^(φ) I)  (2-2)I=Triple−DES(Kr,R ^(φ) I)  (2-3)

In this case, Triple-DES( ) is a function that uses a first argument ascryptography key information and encrypts the value of a second argumentbased on the Triple-DES. The operation φ is an exclusive OR executedevery 64 bits. The last value S is updated as a new seed.

If random numbers are continuously generated, Equations (2-2) and (2-3)are repeated.

The aspects of various cryptography processes applicable to the dataprocessing apparatus according to the present invention have beendescribed. Next, specific processes executed in the present dataprocessing apparatus will be described in detail.

(4) Configuration of Data Stored in Recording and Reproducing Device

FIG. 18 is a view illustrating the contents of data held in the internalmemory 307 configured in the recording and reproducing devicecryptography process section 302 of the recording and reproducing device300 shown in FIG. 3.

As shown in FIG. 18, the internal memory 307 stores the following keysand data:

MKake: recording device authenticating master key for generating anauthentication and key exchange key (hereafter referred to as “Kake”)required for a mutual authentication process executed between therecording and reproducing device 300 and recording device 400 (see FIG.3).

IVake: initial value for the recording device authenticating key.

MKdis: master key for a distribution key for generating a distributionkey Kdis.

IVdis: distribution-key-generating initial value.

Kicva: integrity-check-value-A-generating key for generating theintegrity check value ICVa.

Kicvb: integrity-check-value-B-generating key for generating theintegrity check value ICVb.

Kicvc: content-integrity-check-value-generating key for generating theintegrity check value ICVi (i=1 to N) for each content block.

Kicvt: total-integrity check value-generating key for generating thetotal integrity check value ICVt.

Ksys: system signature key used to add a common signature or ICV to adistribution system.

Kdev: recording and reproducing device signature key that variesdepending on recording and reproducing device and that is used by therecording and reproducing device to add a signature or ICV.

IVmem: initial value that is used for a cryptography process for mutualauthentication, or the like. This is shared by the recording device.

These keys and data are stored in the internal memory 307 configured inthe recording and reproducing device cryptography process section 302.

(5) Configuration of Data Stored in Recording Device

FIG. 19 is a view showing how data are held on the recording device 400.In this figure, the internal memory 405 is divided into a plurality of(in this example, N) blocks each storing the following keys and data:

IDmen: recording device identification information that is unique to therecording device 400.

Kake: authentication key that is used for mutual authentication with therecording and reproducing device 300.

IVmem: initial value that is used for a cryptography process for mutualauthentication, or the like.

Kstr: storage key that is a cryptography key for the block informationtable and other content data.

Kr: random number generating key.

S: seed.

These data are each held in the corresponding block. An external memory402 holds a plurality of (in this example, M) content data. It holds thedata described in FIG. 4 as shown, for example, in FIG. 26 or 27. Thedifference in configuration between FIGS. 26 and 27 will be describedlater.

(6) Mutual Authentication Process Between Recording and ReproducingDevice and Recording Device

(6-1) Outline of Mutual Authentication Process

FIG. 20 is a flow chart illustrating a procedure for an authenticationbetween the recording and reproducing device 300 and the recordingdevice 400. At step S41, the user inserted the recording device 400 intothe recording and reproducing device 300. If, however, the recordingdevice 400 is capable of communication in a non-contact manner, it neednot be inserted thereinto.

When the recording device 400 is set in the recording and reproducingdevice 300, a recording device detecting means (not shown) in therecording and reproducing device 300 shown in FIG. 3 notifies thecontrol section 301 that the recording device 400 has been installed.Then at step S42, the control section 301 of the recording andreproducing device 300 transmits an initialization command to therecording device 400 via the recording device controller 303. Onreceiving the command, the recording device 400 causes the controlsection 403 of the recording device cryptography process section 401 toreceive the command via the communication section 404 and clear anauthentication completion flag if it has been set. That is, anunauthenticated state is set.

Then at step S43, the control section 301 of the recording andreproducing device 300 transmits an initialization command to therecording and reproducing device cryptography process section 302. Atthis point, it also transmits a recording device insertion port number.When the recording device insertion port number is transmitted, even ifa plurality of recording devices 400 are connected to the recording andreproducing device 300, the recording and reproducing device 300 cansimultaneously execute authentication with these recording devices 400and transmit and receive data thereto and therefrom.

On receiving the initialization command, the recording and reproducingdevice cryptography process section 302 of the recording and reproducingdevice 300 causes the control section 306 thereof to clear theauthentication complete flag corresponding to the recording deviceinsertion port number if it has been set. That is, the unauthenticatedstate is set.

Then at step S44, the control section 301 of the recording andreproducing device 300 specifies a key block number used by therecording device cryptography process section 401 of the recordingdevice 400. Details of the key block number will be described later. Atstep S45, the control section 301 of the recording and reproducingdevice 300 reads out the recording device identification informationIDmem stored in the specified key block in the internal memory 405 ofthe recording device 400. At step S46, the control section 301 of therecording and reproducing device 300 transmits the recording deviceidentification information IDmem to the recording and reproducing devicecryptography process section 302 to generate the authentication key Kakebased on the recording device identification information IDmem. Theauthentication key Kake is generated, for example, as follows:Kake=DES(MKake,IDmem ^(φ) IVake)  (3)

In this case, the MKake denotes the master key for the recording deviceauthentication key used to generate the authentication key Kake requiredfor the mutual authentication process executed between the recording andreproducing device 300 and the recording device 400 (see FIG. 3). Themaster key can be stored in the internal memory 307 of the recording andreproducing device 300 as described above. Additionally, the IDmemdenotes the recording device identification information unique to therecording device 400. Furthermore, the IVake denotes the initial key forthe recording device authentication key. In addition, in the aboveequation, the DES( ) denotes a function that uses a first argument ascryptography key and encrypts the value of a second argument based onthe DES. The operation φ denotes an exclusive OR executed every 64 bits.

If, for example, the DES configuration shown in FIG. 7 or 8 is applied,the message M shown in FIGS. 7 and 8 corresponds to the recording deviceidentification information: IDmem, the key K1 corresponds to the masterkey for the device authentication key: MKake, the initial value IVcorresponds to the value: IVake, and the output obtained is theauthentication key Kake.

Then at step S47, the mutual authentication process and the process forgenerating the session key Kses are carried out. The mutualauthentication is executed between the encryption/decryption section 308of the recording and reproducing device cryptography process section 302and the encryption/decryption section 406 of the recording devicecryptography process section 401; the control section 301 of therecording and reproducing device 300 mediates therebetween.

The mutual authentication process can be executed as previouslydescribed in FIG. 13. In the configuration shown in FIG. 13, A and Bcorrespond to the recording and reproducing device 300 and the recordingdevice 400, respectively. First, the recording and reproducing devicecryptography process section 302 of the recording and reproducing device300 generates the random number Rb and transmits the Rb and therecording and reproducing device identification information IDdev, whichis its own ID, to the recording device cryptography process section 401of the recording device 400. The recording and reproducing deviceidentification information IDdev is an identifier unique to areproducing device stored in a memory section configured in therecording and reproducing device 300. The recording and reproducingdevice identification information IDdev may be recorded in the internalmemory of the recording and reproducing device cryptography processsection 302.

On receiving the random number Rb and the recording and reproducingdevice identification information IDdev, the recording devicecryptography process section 401 of the recording device 400 generates anew 64-bit random number Ra, encrypts the data in the DES CBC mode inthe order of the Ra, Rb, and recording and reproducing deviceidentification information IDdev using the authentication key Kake, andreturns them to the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300. Forexample, according to the DES CBC mode process configuration shown inFIG. 7, the Ra, Rb, and IDdev correspond to the M1, M2, and M3,respectively, and when the initial value IV=IVmem, the outputs E1, E2,and E3 are encrypted texts.

On receiving the encrypted texts E1, E2, and E3, the recording andreproducing device cryptography process section 302 of the recording andreproducing device 300 decrypts the received data with theauthentication key Kake. To decrypt the received data, the encryptedtext E1 is first decrypted with the key Kake and the result and theIVmem are exclusive-ORed to obtain the random number Ra. Then, theencrypted text E2 is decrypted with the key Kake, and the result and theE1 are exclusive-ORed to obtain the Rb. Finally, the encrypted text E3is decrypted with the key Kake, and the result and the E2 areexclusive-ORed to obtain the recording and reproducing deviceidentification information IDdev. Of the Ra, Rb, and recording andreproducing device identification information IDdev thus obtained, theRb and recording and reproducing device identification information IDdevare checked for equality to those transmitted by the recording andreproducing device 300. If they are successfully verified, the recordingand reproducing device cryptography process section 302 of the recordingand reproducing device 300 authenticates the recording device 400.

Then, the recording and reproducing device cryptography process section302 of the recording and reproducing device 300 generates a session key(hereafter referred to as “Kses”) used after the authentication. Kses isgenerated using a random number. The Rb, Ra, and Kses are encrypted inthe DES CBC mode in this order using the key Kake and the initial valueIVmem and then returned to the recording device cryptography processsection 401 of the recording device 400.

On receiving the data, the recording device cryptography process section401 of the recording device 400 decrypts the received data with the keyKake. The method for decrypting the received data is similar to thatexecuted by the recording and reproducing device cryptography processsection 302 of the recording and reproducing device 300, so detaileddescription thereof is omitted. Of the Ra, Rb, and Kses thus obtained,the Rb and Ra are checked for equality to those transmitted by therecording device 400. If they are successfully verified, the recordingdevice cryptography process section 401 of the recording device 400authenticates the recording and reproducing device 300. After thesedevices have authenticated each other, the session key Kses is used as acommon key for secret communication after the authentication.

If illegality or inequality is found during the verification of thereceived data, the mutual authentication is considered to have failedand the process is aborted.

If the mutual authentication has been successful, the process proceedsfrom step S48 to step S49 where the recording and reproducing devicecryptography process section 302 of the recording and reproducing device300 holds the session key Kses and where the authentication completeflag is set, indicating that the mutual authentication has beencompleted. Additionally, if the mutual authentication has failed, theprocess proceeds to step S50, the session key Kses is discarded and theauthentication complete flag is cleared. If the flag has already beencleared, the clearing process is not necessarily required.

If the recording device 400 is removed from the recording deviceinsertion port, the recording device detecting means in the recordingand reproducing device 300 notifies the control section 301 of therecording and reproducing device 300 that the recording device 400 hasbeen removed. In response to this, the control section 301 of therecording and reproducing device 300 commands the recording andreproducing device cryptography process section 302 of the recording andreproducing device 300 to clear the authentication complete flagcorresponding to the recording device insertion port number. In responseto this, the recording and reproducing device cryptography processsection 302 of the recording and reproducing device 300 clears theauthentication complete flag corresponding to the recording deviceinsertion port number.

The example has been described where the mutual authentication processis executed in accordance with the procedure shown in FIG. 13, but thepresent invention is not limited to the above described example ofauthentication process. The process may be executed, for example, inaccordance with the above described mutual authentication procedure inFIG. 15. Alternatively, in the procedure shown in FIG. 13, A in FIG. 13may be set as the recording and reproducing device 300, B may be set asthe recording device 400, and the ID that B: recording device 400 firstdelivers to A: recording and reproducing device 300 may be set as therecording device identification information in the key block in therecording device 400. Various processes are applicable to theauthentication process procedure executed in the present invention, andthe present invention is not limited to the above describedauthentication process.

(6-2) Switching Key Block During Mutual Authentication

The mutual authentication process in the data processing apparatusaccording to the present invention is partly characterized in that theauthentication process is executed by configuring a plurality of (forexample, N) key blocks on the recording device 400 side and allowing therecording and reproducing device 300 to specify one of them (step S44 inthe process flow in FIG. 20). As previously described in FIG. 19, theinternal memory 405 configured in the cryptography process section 401of the recording device 400 has a plurality of key blocks formed thereinwhich store various different data such as key data and ID information.The mutual authentication process executed between the recording andreproducing device 300 and the recording device 400 as described in FIG.20 is carried out on one of the plurality of key blocks of the recordingdevice 400 in FIG. 19.

Conventional configurations for executing a mutual authenticationprocess between a recording medium and a reproducing device thereforgenerally use a common authentication key for the mutual authentication.Thus, when the authentication key is to be changed for each productdestination (e.g., country) or each product, key data required forauthentication processes for the recording and reproducing device sideand the recording device side must be changed on both devices.Accordingly, key data required for an authentication process stored in anewly sold recording and reproducing device 300 does not correspond tokey data required for an authentication process stored in a previouslysold recording and reproducing device 300, so the new recording andreproducing device 300 cannot access an old version of recording device400. A similar situation occurs in the relationship between a newversion of recording device 400 and the old version of recording andreproducing device 300.

In the data processing apparatus according to the present invention, keyblocks are stored in the recording device 400 as a plurality ofdifferent key sets as shown in FIG. 19. The recording and reproducingdevice 300 has a key block to be applied to the authentication process.That is, a specified key block set, for example, for each productdestination (e.g., country), product, device type, version, orapplication. This set information is stored in the memory section of therecording and reproducing device 300, for example, the internal memory307 in FIG. 3 or other storage elements of the recording and reproducingdevice 300. It is accessed by the control section 301 during theauthentication process to specify a key block in accordance therewith.

The master key Mkake for the recording device authentication key in theinternal memory 307 of the recording and reproducing device 300 is setin accordance with settings for a specified key block and can correspondonly to that specified key block. It does not establish mutualauthentication with any key blocks other than the specified one.

As is seen in FIG. 19, the internal memory 405 of the recording device400 has N key blocks (1 to N) set. Each store recording deviceidentification information, an authentication key, an initial value, astorage key, a random-number generating key, and a seed. Each key blockstores at least authenticating key data as data varying depending on theblock.

In this manner, the key data configuration of the key block in therecording device 400 varies depending on the block. Thus, for example, akey block with which a certain recording and reproducing device A canexecute the authentication process using the master key MKake for therecording device authentication key stored in the internal memory can beset as a key block No. 1, and a key block with which a recording andreproducing device B with a different specification can execute theauthentication process can be set as another key block, for example, akey block No. 2.

Although described later in detail, when content is stored in theexternal memory 402 of the recording device 400, the storage key Kstrstored in each key block is used to encrypt and store the content. Morespecifically, the storage key is used to encrypt a content key forencrypting a content block.

As shown in FIG. 19, the storage key is configured as a key that variesdepending on the block. Thus, a content stored in a memory of arecording device is prevented from being shared by two differentrecording and reproducing devices 300 set to specify different keyblocks. That is, differently set recording and reproducing devices 300can each use only the contents stored in a recording device 400 that iscompatible with its settings.

Data that can be made common to each key block can be made so while, forexample, only the authenticating key data and the storage key data mayvary depending on the key block.

In a specific example where key blocks comprising a plurality ofdifferent key data are configured in the recording device 400, forexample, different key block numbers to be specified are set fordifferent types of recording and reproducing devices 300 (e.g., aninstalled type, a portable type, and the like), or different specifiedkey blocks are set for different applications. Furthermore, differentkey blocks may be set for different territories. For example, the keyblock No. 1 is specified for recording and reproducing devices 300 soldin Japan, and the key block No. 2 is specified for recording andreproducing devices 300 sold in the U.S. With such a configuration,content that is used in different territories and that is stored in eachrecording device 400 with a different storage key cannot be used in arecording and reproducing device 300 with different key settings even ifa recording device 400 such as a memory card is transferred from theU.S. to Japan or vice versa, thereby preventing the illegal ordisorderly distribution of the content stored in the memory.Specifically, this serves to exclude a state where a content key Kconencrypted with different storage keys Kstr can be mutually used in twodifferent countries.

Moreover, at least one of the key blocks 1 to N in the internal memory405 of the recording device 400 shown in FIG. 19, (for example, the No.N key block) may be shared by any recording and reproducing device 300.

For example, when the key block No. N and the master key MKake for therecording device authentication key, (which is capable ofauthentication), are stored in all apparatuses, content can bedistributed irrespective of the type of the recording and reproducingdevice 300, the type of the application, or the destination country. Forexample, encrypted content stored in a memory card with the storage keystored in the key block No. N can be used in any apparatus. Music dataor the like can be decrypted and reproduced from a memory card byencrypting the data with the storage key in a shared key block, storingthem in the memory card, and setting the memory card in, for example, aportable sound reproducing device storing the master key MKake for therecording device authentication key, which is also shared.

FIG. 21 shows an example of the usage of the recording device of thepresent data processing apparatus, which has a plurality of key blocks.For instance, a recording and reproducing device 2101 is a product soldin Japan and has a master key that establishes an authentication processwith the key blocks No. 1 and No. 4 in the recording device. A recordingand reproducing device 2102 is a product sold in the U.S. and has amaster key that establishes an authentication process with the keyblocks No. 2 and No. 4 in the recording device. A recording andreproducing device 2103 is a product sold in the EU and has a master keythat establishes an authentication process with the key blocks No. 3 andNo. 4 in the recording device.

For example, the recording and reproducing device 2101 establishesauthentication with the key block 1 or 4 in the recording device A 2104to store, in the external memory, content encrypted via the storage keystored in that key block. The recording and reproducing device 2102establishes authentication with the key block 2 or 4 in the recordingdevice B 2105 to store, in the external memory, content encrypted viathe storage key stored in that key block. The recording and reproducingdevice 2103 establishes authentication with the key block 3 or 4 in therecording device C 2106 to store, in the external memory, contentencrypted via the storage key stored in that key block. Then, if therecording device A 2104 is installed in the recording and reproducingdevice 2102 or 2103, content encrypted with the storage key in the keyblock 1 is unavailable because authentication is not established betweenthe recording and reproducing device 2102 or 2103 and the key block 1.On the other hand, content encrypted with the storage key in the keyblock 4 is available because authentication is established between therecording and reproducing device 2102 or 2103 and the key block 4.

As described above, in the data processing apparatus according to thepresent invention, the key blocks comprising the plurality of differentkey sets are configured in the recording device 400, while the recordingand reproducing device 300 stores the master key enabling authenticationfor a particular key block, thereby enabling the setting of restrictionson content use.

Moreover, a plurality of key blocks, for example, 1 to k may bespecified in one recording and reproducing device 300, while a pluralityof key blocks p and q may be specified in the other recording andreproducing devices 300. Additionally, a plurality of sharable keyblocks may be provided.

(7) Process for Downloading from Recording and Reproducing Device toRecording Device

Next, a process for downloading content from the recording andreproducing device 300 to the external memory of the recording device400 in the present data processing apparatus will be explained.

FIG. 22 is a flow chart illustrating a procedure for downloading acontent from the recording and reproducing device 300 to the recordingdevice 400. In this figure, the above described mutual authenticationprocess is assumed to have been completed between the recording andreproducing device 300 and the recording device 400.

At step S51, the control section 301 of the recording and reproducingdevice 300 uses the read section 304 to read data of a predeterminedformat out from the medium 500 storing contents or uses thecommunication section 305 to receive data from the communication means600 in accordance with a predetermined format. Then, the control section301 of the recording and reproducing device 300 transmits the headersection (see FIG. 4) of the data to the recording and reproducing devicecryptography process section 302 of the recording and reproducing device300.

Next, at step S52, the control section 306 of the recording andreproducing device cryptography process section 302, which has receivedthe header at step S51, causes the encryption/decryption section 308 ofthe recording and reproducing device cryptography process section 302 tocalculate the ICVa. The ICVa is calculated in accordance with the ICVcalculation method described in FIG. 7, using as a key theintegrity-check-value-A-generating key Kicva stored in the internalmemory 307 of the recording and reproducing device cryptography processsection 302 and using the content ID and the usage policy as a message,as shown in FIG. 23. The initial value may be IV=0 or may be theintegrity-check-value-A-generating initial value IVa may be used whichis stored in the internal memory 307 of the recording and reproducingdevice cryptography process section 302. Finally, the integrity checkvalue A and the check value: ICVa stored in the header are comparedtogether, and if they are equal, the process proceeds to step S53.

As previously described in FIG. 4, the check value A, ICVa, is used toverify that the content ID and the usage policy have not been tamperedwith. If the integrity check value A calculated in accordance with theICV calculation method described in FIG. 7 equals the check value ICVastored in the header, it is determined that the content ID and the usagepolicy have not been tampered with. The integrity check value A from onemethod in FIG. 7 uses, as a key, the integrity-check-value-A-generatingkey Kicva stored in the internal memory 307. It uses the content ID andthe usage policy as a message.

Next, at step S53, the control section 306 of the recording andreproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to generate the distribution keyKdis. The distribution key Kdis is generated, for example, as follows:Kdis=DES(MKdis,ContentID ^(φ) IVdis)  (4)

In this case, the MKdis denotes the master key for the distribution keyfor generating the distribution key Kdis The master key can be stored inthe internal memory 307 of the recording and reproducing device 300 asdescribed above. In addition, the content ID is identificationinformation for the header section of content data. The IVdis denotesthe initial value for the distribution key. Additionally, in the aboveequation (4), the DES( ) denotes a function that uses a first argumentas cryptography key and that encrypts the value of a second argument.The operation φ denotes an exclusive OR executed every 64 bits.

At step S54, the control section 306 of the recording and reproducingdevice cryptography process section 302 uses the encryption/decryptionsection 308 of the cryptography process section 302, as well as thedistribution key Kdis generated at step S53, to decrypt the blockinformation table key Kbit and content key Knon (see FIG. 4). Kbit andKdis are stored in the header section of the data obtained from themedium 500 via the read section 304 or received from the communicationmeans 600 via the communication section 305. As shown in FIG. 4, theblock information table key Kbit and the content key Knon are encryptedbeforehand with the distribution key Kdis on the medium 500, such as aDVD or CD, or on a communication means 600 such as the Internet.

Further, at step S55, the control section 306 of the recording andreproducing device cryptography process section 302 uses theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to decrypt the block informationtable (BIT) with the block information table key Kbit decrypted at stepS54. The block information table (BIT), as shown in FIG. 4, is encryptedbeforehand with the block information table key Kbit on the medium 500such as the DVD or CD, or the communication means 600 such as theInternet.

Further, at step S56, the control section 306 of the recording andreproducing device cryptography process section 302 divides the blockinformation table key Kbit, the content key Kcon, and the blockinformation table (BIT) into 8-byte pieces, which are all exclusive-ORed(any operation such as an addition or subtraction may be used). Next,the control section 306 of the recording and reproducing devicecryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the integrity check value B (ICVb). The ICVb isgenerated by using as a key the integrity-check-value-B-generating keyKicvb stored in the internal memory 307 of the recording and reproducingdevice cryptography process section 302. This is done to decrypt thepreviously calculated exclusive-ORed value based on the DES, as shown inFIG. 24. Finally, the integrity check value B and the ICVb in the headerare compared together, and if they are equal, the process proceeds tostep S57.

As previously described in FIG. 4, the check value B, ICVb is used toverify that the block information table key Kbit, the content key Kcon,and the block information table (BIT) have not been tampered with. Ifthe integrity check value B equals the check value ICVb stored in theheader, it is determined that the block information table key Kbit, thecontent key Kcon, and the block information table have not been tamperedwith. The integrity check value B is generated by using, as a key, theintegrity-check-value-B-generating key Kicvb stored in the internalmemory 307, dividing the block information table key Kbit, the contentkey Kcon, and the block information table (BIT) into 8-byte pieces;exclusive-Oring these data; and encrypting the exclusive-ORed data basedon the DES.

At step S57, the control section 306 of the recording and reproducingdevice cryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate an intermediate integrity check value. Theintermediate value is calculated in accordance with the ICV calculationmethod described in FIG. 7. This is done using thetotal-integrity-check-value generating key Kicvt as a key. The key isstored in the internal memory 307 of the recording and reproducingdevice cryptography process section 302, and uses the integrity checkvalues A and B and all the held content integrity check values as amessage. The initial value may be IV=0 or thetotal-integrity-check-value-generating initial value IVt may be used.IVt is stored in the internal memory 307 of the recording andreproducing device cryptography process section 302. Additionally, theintermediate integrity check value generated is stored in the recordingand reproducing device cryptography process section 302 of the recordingand reproducing device 300, as required.

This intermediate integrity check value is generated using the integritycheck values A and B and all the content integrity check values as amessage. Data verified by each of these integrity check values may beverified by collating them with the intermediate integrity check value.In this embodiment, however, a plurality of different integrity checkvalues can be separately generated based on the intermediate integritycheck value. This is done so that the process for verifying the absenceof tamper which process is executed for shared data for the entiresystem and the verification process for identifying occupied dataoccupied only by each recording and reproducing device 300 after thedownload process can be distinguishably executed. The plurality ofdifferent integrity check values are, for instance, total integritycheck values ICVt and the check value ICVdev unique to the recording andreproducing device 300. These integrity check values will be describedlater.

The control section 306 of the recording and reproducing devicecryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the total integrity check value ICVt. The totalintegrity check value ICVt is generated by using as a key a systemsignature key Ksys to decrypt the intermediate integrity check valuebased on the DES. Ksys can be stored in the internal memory 307 of therecording and reproducing device cryptography process section 302.Finally, the total integrity check value ICVt generated and the ICVt inthe header stored at step S51 are compared together, and if they areequal, the process proceeds to step S58. The system signature key Ksysis common to a plurality of recording and reproducing devices 300, thatis, the entire system executing the process of recording and reproducingcertain data.

As previously described in FIG. 4, the total integrity check value ICVtis used to verify that all of the integrity check values ICVa and ICVband the integrity check value for each content block have not beentampered with. Thus, if the total integrity check value generated bymeans of the above-described process equals the integrity check valueICVt, stored in the header, it is determined that all of the integritycheck values ICVa and ICVb and the integrity check value for eachcontent block have not been tampered with.

Then at step S58, the control section 301 of the recording andreproducing device 300 takes content block information out from theblock information table (BIT) and checks whether any content block is tobe verified. If any content block is to be verified, the contentintegrity check value has been stored in the block information in theheader.

If any content block is to be verified, the control section 301 readsthis content block out from the medium 500 by using the read section 304of the recording and reproducing device 300 or received fromcommunicating means 600 by using the communication section 305 of therecording and reproducing device 300. Control section 301 transmits thecontent block to the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300. Onreceiving the content block, the control section 306 of the recordingand reproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to calculate the contentintermediate value.

The content intermediate value is generated by using the content keyKcon decrypted at step S54 to decrypt an input content block in the DESCBC mode, separating the resulting data into 8-byte pieces, andexclusive-ORing all these pieces (any operation such as an addition orsubtraction may be used).

Then, the control section 306 of the recording and reproducing devicecryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the content integrity check value. The contentintegrity check value is generated by using as a key thecontent-integrity-check-value-generating key Kicvc to decrypt thecontent intermediate value based on the DES. Kicvc is stored in theinternal memory 307 of the recording and reproducing device cryptographyprocess section 302. Then, the control section 306 of the recording andreproducing device cryptography process section 302 compares thiscontent integrity check value with the ICV in the content block receivedfrom the control section 301 of the recording and reproducing device 300at step S51. It then passes the result to the control section 301 of therecording and reproducing device 300. On receiving the result, and ifthe verification has been successful, the control section 301 of therecording and reproducing device 300 takes out the next content block tobe verified and causes the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 toverify this content block. Similar verification processes are repeateduntil all the content blocks are verified. The initial value may be IV=0or the content-integrity-check-value-generating initial value IVc usedmay be that which is stored in the internal memory 307 of the recordingand reproducing device cryptography process section 302 (if the headergenerating side uses the same settings). Additionally, all the checkedcontent integrity check values are held in the recording and reproducingdevice cryptography process section 302 of the recording and reproducingdevice 300. Furthermore, the recording and reproducing devicecryptography process section 302 of the recording and reproducing device300 monitors the order in which the content blocks are verified. This isdone to consider whether the authentication has failed (if the order isincorrect) or if it verifies the same content block twice or more. Ifall the content blocks have been successfully verified, the processproceeds to step S59.

Then at step S59, the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 causesthe encryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to encrypt the block informationtable key Kbit and content key Kcon decrypted at step S54. This is doneusing the session key Kses made sharable during the mutualauthentication. The control section 301 of the recording and reproducingdevice 300 reads the block information table key Kbit and content keyKcon from the recording and reproducing device cryptography processsection 302 of the recording and reproducing device 300. The blockinformation table key Kbit and content key Kcon being decrypted usingthe session key Kses. The control section 301 then transmits these datato the recording device 400 via the recording device controller 303 ofthe recording and reproducing device 300.

Then at step S60, on receiving the block information table key Kbit andcontent key Kcon transmitted from the recording and reproducing device300, the recording device 400 causes the encryption/decryption section406 of the recording device cryptography process section 401 to decryptthe received data using the session key Kses. Kses is made sharableduring the mutual authentication. Encryption/decryption section 406reencrypts the decrypted data with the storage key Kstr, which is uniqueto the recording device and is stored in the internal memory 405 of therecording device cryptography process 401. Finally, the control section301 of the recording and reproducing device 300 reads the blockinformation key Kbit and the content key Kcon out from the recordingdevice 400 via the recording device controller 303 of the recording andreproducing device 300. The block information key Kbit and the contentkey Kcon can be reencrypted with the storage key Kstr. These are thensubstituted with the block information key Kbit and content key Kconencrypted with the distribution key Kdis.

At step S61, the control section 301 of the recording and reproducingdevice 300 takes the localization field out from the usage policy in theheader section of the data to determine whether the downloaded contentcan be used only in this recording and reproducing device 300 (in thiscase, the localization field is set to 1) or also by other similarrecording and reproducing devices 300 (in this case, the localizationfield is set to 0). If the result of the determination shows that thelocalization field is set to 1, the process proceeds to step S62.

At step S62, the control section 301 of the recording and reproducingdevice 300 causes the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 tocalculate the integrity check value unique to the recording andreproducing device 300. The integrity check value unique to therecording and reproducing device 300 is generated by using as a key arecording and reproducing device signature key Kdev to decrypt theintermediate integrity check value based on the DES, the intermediateintegrity check value being held at step S58. Kdev is stored in theinternal memory 307. The calculated integrity check value ICVdev uniqueto the recording and reproducing device 300 substitutes for the totalintegrity check value ICVt.

As previously described, the system signature key Ksys is used to add acommon signature, or ICV, to the distribution system. The recording andreproducing device 300 signature key Kdev varies depending on therecording and reproducing device 300 and is used by the recording andreproducing device to add a signature or ICV. That is, data signed withthe system signature key Ksys are successfully checked by a system(recording and reproducing device 300) having the same system signaturekey. Specifically, such data have the same total integrity check valueICVt so as to be sharable. If, however, data is signed with therecording and reproducing device signature key Kdev the data stored in arecording device after the signing cannot be reproduced if an attempt ismade to reproduce it after this recording device has been inserted inanother recording and reproducing device 300. That is, an error occursdue to the unequal integrity check values ICVdev unique to the recordingand reproducing device 300.

Thus, in the data processing apparatus according to the presentinvention, the setting of the localization field enables contents to bearbitrarily set so as to be shared throughout the entire system or usedonly by particular recording and reproducing devices 300.

At step S63, the control section 301 of the recording and reproducingdevice 300 stores the content in the external memory 402 of therecording device 400.

FIG. 26 is a view showing how the content is stored in the recordingdevice 400 if the localization field is set to 0. FIG. 27 is a viewshowing how the content is stored in the recording device 400 if thelocalization field is set to 1. The only difference between FIGS. 26 and4 is whether the content block information key Kbit and the content keyKcon are encrypted with the distribution key Kdis or the storage keyKstr. The difference between FIGS. 27 and 26 is that the integrity checkvalue calculated from the intermediate integrity check value isencrypted with the system signature key Ksys in FIG. 26, whereas it isencrypted with the recording and reproducing device signature key Kdevunique to the recording and reproducing device 300 in FIG. 27.

In the process flow of FIG. 22, if the verification of the integritycheck value A has failed at step S52, if the verification of theintegrity check value B has failed at step S56, if the verification ofthe total integrity check value ICVt has failed at step S57, or if theverification of the content block content integrity check value hasfailed at step S58, then the process proceeds to step S64 to provide apredetermined error display because the verification is no good.

In addition, if the localization field is 0 at step S61, the processskips step S62 to advance to step S63.

(8) Process Executed by Recording and Reproducing Device to ReproduceInformation Stored in Recording Device

Next, a process executed by the recording and reproducing device 300 toreproduce content information stored in the external memory 402 of therecording device 400 is analyzed.

FIG. 28 illustrates a procedure executed by the recording andreproducing device 300 to read content out from the recording device 400and use it. In FIG. 28, the mutual authentication is assumed to havebeen completed between the recording and reproducing device 300 and therecording device 400.

At step S71, the control section 301 of the recording and reproducingdevice 300 uses the recording device controller 303 to read the contentout from the external memory 402 of the recording device 400. Thecontrol section 301 of the recording and reproducing device 300 thentransmits the header section of the data to the recording andreproducing device cryptography process section 302 of the recording andreproducing device 300. Step S72 is similar to step S52 described in“(7) Process for Downloading from Recording and Reproducing Device toRecording Device.” At this step, the control section 306 of therecording and reproducing device cryptography process section 302, whichhas received the header, causes the encryption/decryption section 308 ofthe recording and reproducing device cryptography process section 302 tocalculate the integrity check value A. The integrity check value A iscalculated in accordance with an ICV calculation method similar to thatdescribed in FIG. 7, using, as a key, theintegrity-check-value-A-generating key Kicva and using the content IDand the usage policy as a message, as shown in FIG. 23. Kicva can bestored in the internal memory 307 of the recording and reproducingdevice cryptography process section 302.

As previously described, the check value A, ICVa, is used to verify thatthe content ID and the usage policy have not been tampered with. If theintegrity check value A calculated in accordance with the ICVcalculation method described in FIG. 7 equals the check value ICVastored in the header, it is determined that the content ID and usagepolicy stored in the recording device 400 have not been tampered with.Integrity check value A is calculated using, as a key, theintegrity-check-value-A-generating key Kicva stored in the internalmemory 307 and using the content ID and the usage policy as a message.

Then at step S73, the control section 301 of the recording andreproducing device 300 takes the block information table key Kbit andthe content key Kcon out from the read-out header section. It thentransmits them to the recording device 400 via the recording devicecontroller 303 of the recording and reproducing device 300. On receivingthe block information table key Kbit and the content key Kcontransmitted from the recording and reproducing device 300, the recordingdevice 400 causes the encryption/decryption section 406 of the recordingdevice cryptography process section 401 to decrypt the received datawith the storage key Kstr, and to then reencrypt the decrypted datausing the session key Kses made sharable during the mutualauthentication. Kstr is unique to the recording device which is storedin the internal memory 405. Then, the control section 301 of therecording and reproducing device 300 reads the block information keyKbit and the content key Kcon out from the recording device 400 via therecording device controller 303 of the recording and reproducing device300. The block information key Kbit and the content key Kcon can bereencrypted with the session key Kses from the recording device 400.

Then at step S74, the control section 301 of the recording andreproducing device 300 transmits the received block information key Kbitand content key Kcon to the recording and reproducing devicecryptography process section 302 of the recording and reproducing device300. The block information key Kbit and content key Kcon can bereencrypted with the session key Kses.

On receiving the block information key Kbit and content key Kconreencrypted with the session key Kses, the recording and reproducingdevice cryptography process section 302 of the recording and reproducingdevice 300 causes the encryption/decryption section 308 of the recordingand reproducing device cryptography process section 302 to decrypt theblock information key Kbit and content key Kcon encrypted with thesession key Kses. This is done using the session key Kses made sharableduring the mutual authentication. The recording and reproducing devicecryptography process section 302 then causes the encryption/decryptionsection 308 to decrypt the block information table received at step S71.This is done using the decrypted block information table key Kbit.

The recording and reproducing device cryptography process section 302 ofthe recording and reproducing device 300 substitutes the decrypted blockinformation table key Kbit, content key Kcon, and block informationtable BIT with those received at step S71 for retention. In addition,the control section 301 of the recording and reproducing device 300reads the decrypted block information table BIT out from the recordingand reproducing device cryptography process section 302 of the recordingand reproducing device 300.

Step S75 is similar to step S56 described in “(7) Process forDownloading from Recording and Reproducing Device to Recording Device.”The control section 306 of the recording and reproducing devicecryptography process section 302 divides the block information table keyKbit, content key Kcon, and block information table (BIT) read out fromthe recording device 400, into 8-byte pieces and then exclusive-ORs allof them. The control section 306 of the recording and reproducing devicecryptography process section 302 then causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate BICVb. ICVb is generated by using as a key theintegrity-check-value-B-generating key Kicvb stored in the internalmemory 307 of the recording and reproducing device cryptography processsection 302, as shown in the previously described FIG. 24. This is doneto encrypt the previously calculated exclusive-ORed value based on theDES. Finally, the check value B and the ICVb in the header are comparedtogether, and if they are equal, the process proceeds to step S76.

As previously described, the check value B, ICVb, is used to verify thatthe block information table key Kbit, the content key Kcon, and theblock information table have not been tampered with. If the integritycheck value B generated by using as a key theintegrity-check-value-B-generating key Kicvb equals the check value ICVbstored in the header of the data read out from the recording device 400,it is determined that the block information table key Kbit, the contentkey Kcon, and the block information table have not been tampered with.Kicvb is stored in the internal memory 307. The block information tablekey Kbit, the content key Kcon, and the block information table (BIT)read from the recording device 400 are divided into 8-byte pieces. Thisdata is exclusive-ORed. The exclusive-ORed data is encrypted based onthe DES.

At step S76, the control section 306 of the recording and reproducingdevice cryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the intermediate integrity check value. Theintermediate value is calculated in accordance with the ICV calculationmethod described in FIG. 7 or the like. This is done using thetotal-integrity-check-value-generating key Kicvt as a message. Kicvt isstored in the internal memory 307. Kicvt incorporates the integritycheck values A and B and all the held content integrity check values.The initial value may be IV=0 or thetotal-integrity-check-value-generating initial value IVt may be used.Additionally, the intermediate integrity check value is stored in therecording and reproducing device cryptography process section 302.

Then at step S77, the control section 301 of the recording andreproducing device 300 takes the localization field out from the usagepolicy (contained in the header section of the data read out from theexternal memory 402 of the recording device 400), to determine whetherthe downloaded content can be used only in this recording andreproducing device 300 (in this case, the localization field is set to1), or also by other similar recording and reproducing devices 300 (inthis case, the localization field is set to 0). If the result of thedetermination shows that the localization field is set to 1, that is,the process proceeds to step S80. A value of 1 means that it is set suchthat the downloaded content can be used only in this recording andreproducing device 300. If the localization is set to 0, then theprocess proceeds to step S78. A value of 0 means that it is set suchthat the content can also be used by other similar recording andreproducing device 300. Step S77 may be processed by the cryptographyprocess section 302.

At step S78, the total integrity check value ICVt is calculated in thesame manner as step S58 described in “(7) Process for Downloading fromRecording and Reproducing Device to Recording Device.” That is, thecontrol section 306 of the recording and reproducing device cryptographyprocess section 302 causes the encryption/decryption section 308 of therecording and reproducing device cryptography process section 302 tocalculate the total integrity check value ICVt. The total integritycheck value ICVt is generated by using a system signature key Ksys as akey to encrypt the intermediate integrity check value based on the DES,as shown in FIG. 25. Ksys can be stored in the internal memory 307 ofthe recording and reproducing device cryptography process section 302.

Then the process proceeds to step S79 to compare the total integritycheck value ICVt generated at step S78 with the ICVt in the headerstored at step S71. If the values are equal, the process proceeds tostep S82.

As previously described, the total integrity check value ICVt is used toverify that the integrity check values ICVa and ICVb and all the contentblock integrity check values have not been tampered with. Thus, if thetotal integrity check value generated by means of the above describedprocess equals the integrity check value ICVt stored in the header, itis determined that the integrity check values ICVa and ICVb and all thecontent block integrity check values have not been tampered with in thedata stored in the recording device 400.

If the result of the determination at step S77 shows that thelocalization field is set such that the downloaded content can be usedonly in this recording and reproducing device 300, that is, it is set to1, the process proceeds to step S80.

At step S80, the control section 306 of the recording and reproducingdevice cryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the integrity check value ICVdev unique to therecording and reproducing device 300. The integrity check value ICVdevunique to the recording and reproducing device 300 is generated, asshown in the previously described FIG. 25, by using a recording andreproducing device signature key Kdev as a key to encrypt theintermediate integrity check value based on the DES, the intermediateintegrity check value being held at step S58. Kdev is unique to therecording and reproducing device, and is stored in the internal memory307. At step S81, the check value ICVdev (unique to the recording andreproducing device 300) calculated at step S80 is compared with theICVdev stored at step S71. If they are equal, the process proceeds tostep S82.

Thus, data signed with the same system signature key Ksys aresuccessfully checked by a system (recording and reproducing device 300)having the same system signature key. That is, such data have the sametotal integrity check value ICVt so as to be sharable. If, however, datais signed with the recording and reproducing device signature key Kdev,the data stored in a recording device 400 after the signing cannot bereproduced if an attempt is made to reproduce them after this recordingdevice 400 has been inserted in another recording and reproducing device400. That is, an error occurs due to a mismatch in the integrity checkvalue ICVdev unique to the recording and reproducing device 300.Accordingly, the setting of the localization field enables content to bearbitrarily set so as to be shared throughout the entire system or usedonly by particular recording and reproducing devices 300.

At step S82, the control section 301 of the recording and reproducingdevice 300 takes content block information out from the blockinformation table (BIT) (read out at step S74) and checks whether anycontent block is to be encrypted. If any content block is to beencrypted, the control section 301 reads this content block out from theexternal memory 402 of the recording device 400 via the recording devicecontroller 303 of the recording and reproducing device 300. It thentransmits the content block to the recording and reproducing devicecryptography process section 302 of the recording and reproducing device300. On receiving the content block, the control section 306 of therecording and reproducing device cryptography process section 302 causesthe encryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to decrypt the content. Thecontrol section 306 also causes the encryption/decryption section 308 tocalculate the content integrity check value at step S83, if the contentblock is to be verified.

Step S83 is similar to step S58 described in “(7) Process forDownloading from Recording and Reproducing Device to Recording Device.”The control section 301 of the recording and reproducing device 300takes content block information out from the block information table(BIT) and determines from the stored content integrity check valuewhether any content block is to be verified. If any content block is tobe verified, the control section 301 receives this content block fromthe external memory 402 of the recording device 400 and transmits it tothe recording and reproducing device cryptography process section 302 ofthe recording and reproducing device 300. On receiving the contentblock, the control section 306 of the recording and reproducing devicecryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the content intermediate value.

The content intermediate value is generated by using the content keyKcon (decrypted at step S74) to decrypt the input content block in theDES CBC mode, separating the resulting data into 8-byte pieces, andexclusive-ORing all these pieces.

Then, the control section 306 of the recording and reproducing devicecryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the content integrity check value. The contentintegrity check value is generated by using as a key thecontent-integrity-check-value-generating key Kicvc to encrypt thecontent intermediate value based on the DES. Kicvc is stored in theinternal memory 307. Then, the control section 306 of the recording andreproducing device cryptography process section 302 compares thiscontent integrity check value with the ICV in the content block receivedfrom the control section 301 of the recording and reproducing device 300at step S71, and passes the result to the control section 301 of therecording and reproducing device 300. On receiving the result (and ifthe verification has been successful), the control section 301 of therecording and reproducing device 300 takes out the next content block tobe verified. It causes the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 toverify this content block. Similar verification processes are repeateduntil all the content blocks are verified. The initial value may be IV=0or the content-integrity-check-value-generating initial value IVc may beused which is stored in the internal memory 307 of the recording andreproducing device cryptography process section 302. Additionally, allthe checked content integrity check values are held in the recording andreproducing device cryptography process section 302 of the recording andreproducing device 300. Furthermore, the recording and reproducingdevice cryptography process section 302 of the recording and reproducingdevice 300 monitors the order in which the content blocks are verified.This is done to consider the authentication to have failed if the orderis incorrect or if it is caused to verify the same content block twiceor more.

The control section 301 of the recording and reproducing device 300receives the result of the comparison of the content integrity checkvalue. If no content block is to be verified, all the results ofcomparisons will be successful. If the verification has been successful,it takes the decrypted content from the recording and reproducing devicecryptography process section 302 of the recording and reproducing device300. It then takes out next content block to be verified and causes therecording and reproducing device cryptography process section 302 of therecording and reproducing device 300 to decrypt this content block.Similar verification processes are repeated until all the content blocksare decrypted.

At step S83, if the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300determines after the verification process that the content integritycheck values are not equal, it considers the verification to have failedand avoids decrypting the remaining contents. In addition, the recordingand reproducing device cryptography process section 302 of the recordingand reproducing device 300 monitors the order in which the contentblocks are decrypted. This is done to consider the decryption to havefailed if the order is incorrect or if it is caused to decrypt the samecontent block twice or more.

If the verification of the integrity check value A has failed at stepS72, if the verification of the integrity check value B has failed atstep S75, if the verification of the total integrity check value ICVthas failed at step S79, if the verification of the integrity check valueICVdev unique to the recording and reproducing device 300 has failed atstep S81, or if the verification of the content block content integritycheck value has failed at step S81, then the process proceeds to stepS84 to provide a predetermined error display because the verification isno good.

As described above, not only important data or content can be encrypted,concealed, or checked for tampering when the content is downloaded orused. This can be done even if data on a recording medium are simplycopied to another recording medium. The content can be prevented frombeing correctly decrypted because the block information table key Kbit(for decrypting the block information table BIT) and the content keyKcon (for decrypting the content) are stored with the storage key Kstrunique to the recording medium. More specifically, at step S74 in FIG.28, another recording device 400 cannot decrypt the data correctlybecause each recording device 400 decrypts data encrypted with adifferent storage key Kstr.

(9) Key Exchanging Process after Mutual Authentication

The data processing apparatus according to the present invention ispartly characterized in that the recording device 400 can be used onlyafter the above described mutual authentication process between therecording and reproducing device 300 and the recording device 400, andalso in that the use form of the recording device is limited.

For example, to prevent a user from generating a recording device 400such as a memory card, in which content is stored by means of illegalcopying or the like, and setting this recording device 400 in arecording and reproducing device 300 for use, the mutual authenticationprocess is executed between the recording and reproducing device 300 andthe recording device 400. Content (that may be encrypted) can betransferred between the recording and reproducing device 300 and therecording device 400 only if they have been mutually authenticated.

To achieve the above restrictive process, according to the present dataprocessing apparatus, all the processes in the cryptography processsection 401 of the recording device 400 are executed based on presetcommand strings. That is, the recording device 400 has such a commandprocess configuration that it sequentially obtains commands from aregister based on command numbers. FIG. 29 is a view illustrating thecommand process configuration of the recording device 400.

As shown in FIG. 29, between the recording and reproducing device 300having the recording and reproducing device cryptography process section302 and the recording device 400 having the recording devicecryptography process section 401, command numbers (No.) are output fromthe recording device controller 303 to the communication section(including a reception register) 404 of the recording device 400 underthe control of the control section 301 of the recording and reproducingdevice 300.

The recording device 400 has a command number managing section 2901 inthe control section 403 of the cryptography process section 401. Thecommand number managing section 2901 holds a command register 2902.Command register 2902 stores command strings corresponding to commandnumbers output from the recording and reproducing device 300. In thecommand strings, command numbers 0 to y are sequentially associated withexecution commands (as shown in the right of FIG. 29). The commandnumber managing section 2901 monitors command numbers output from therecording and reproducing device 300 to take corresponding commands outfrom a command register 2902 for execution.

In command sequences stored in the command register 2902, a commandstring for an “authentication process sequence” is associated with theleading command numbers 0 to k. Furthermore, command numbers p to sfollowing the command string for the authentication process sequence areassociated with a “decryption, key exchange, and encryption processcommand sequence 1,” and the following command numbers u to y areassociated with a “decryption, key exchange, and encryption processcommand sequence 2.”

As previously described for the authentication process flow in FIG. 20,when the recording device 400 is installed in the recording andreproducing device 300, the control section 301 of the recording andreproducing device 300 transmits an initialization command to therecording device 400 via the recording device controller 303. Onreceiving the command, the recording device 400 causes the controlsection 403 of the recording device cryptography process section 401 toreceive the command via the communication section 404. It then clears anauthentication flag 2903. That is, an unauthenticated state is set.Alternatively, in such a case that power is supplied from the recordingand reproducing device 300 to the recording device 400, theunauthenticated state may be set upon power-on.

Then, the control section 301 of the recording and reproducing device300 transmits an initialization command to the recording and reproducingdevice cryptography process section 302. At this point, it alsotransmits a recording device insertion port number. When the recordingdevice insertion port number is transmitted, even if a plurality ofrecording devices 400 are connected to the recording and reproducingdevice 300, the recording and reproducing device 300 can simultaneouslyexecute authentication with these recording devices 400 and transmit andreceive data thereto and therefrom.

On receiving the initialization command, the recording and reproducingdevice cryptography process section 302 of the recording and reproducingdevice 300 causes the control section thereof to clear theauthentication flag 2903 corresponding to the recording device insertionport number. That is, the unauthenticated state is set.

Once this initialization process has been completed, the control section301 of the recording and reproducing device 300 sequentially outputscommand numbers via the recording device controller 303. This is done inan ascending order starting with the command number 0. The commandnumber managing section 2901 of the recording device 400 monitors thecommand numbers input from the recording and reproducing device 300 toascertain that they are sequentially input starting with the commandnumber 0. It obtains the corresponding commands from the commandregister 2902 to execute various processes, such as the authenticationprocess. If the input command numbers are not in a specified order, anerror occurs and a command number acceptance value is reset to aninitial state. That is, an executable command number is reset at 0.

In the command sequences stored in the command register 2902, thecommand numbers are imparted so as to carry out the authenticationprocess first. Following this process sequence, the key exchange isdecrypted, and an encryption process sequence is stored.

A specific example of decrypting the key exchange and the encryptionprocess sequence will be explained with reference to FIGS. 30 and 31.

FIG. 30 shows part of the process executed in downloading content fromthe recording and reproducing device 300 to the recording device 400 aspreviously described in FIG. 22. Specifically, this process is executedbetween steps 59 and 60 in FIG. 22.

In FIG. 30, at step S3001, the recording device 400 receives data (ex.the block information table Kbit and the content key Kcon) encryptedwith the session key Kses, from the recording and reproducing device300. Thereafter, the command strings p to s (shown in the abovedescribed FIG. 29) are started. The command strings p to s are startedafter the authentication process commands 0 to k have been completed tocause authentication flag 2903 (shown in FIG. 29) to be set to indicatethe completion. This is ensured by the command number managing section2901 by accepting the command numbers only in the ascending orderstarting with 0.

At step S3002, the recording device stores the data (ex. the blockinformation table Kbit and the content key Kcon) received from therecording and reproducing device 300 and encrypted with the session keyKses, in the register.

At step S3003, a process is executed which takes the data (ex. the blockinformation table Kbit and the content key Kcon) encrypted with thesession key Kses out from the register and decrypts them with thesession key Kses.

At step S3004, a process is executed which encrypts the data (ex. theblock information table Kbit and the content key Kcon) decrypted withthe session key Kses, using the storage key Kstr.

The above process steps 3002 to 3004 correspond to processes included inthe command numbers p to s in the command register previously describedin FIG. 29. These processes are sequentially executed by the recordingdevice cryptography process section 401 in accordance with the commandnumbers p to s received by the command number managing section 2901 ofthe recording device 400 from the recording and reproducing device 300.

At the next step S3005, the data (ex. the block information table Kbitand the content key Kcon), encrypted with the storage key Kstr, arestored in the external memory of the recording device. At this step, therecording and reproducing device 300 may read the data encrypted withthe storage key Kstr out from the recording device cryptography processsection 401 and then stores them in the external memory 402 of therecording device 400.

The above described steps S3002 to S3004 constitute an uninterruptible,continuously-executed execution sequence. This is done even if, forexample, the recording and reproducing device 300 issues a data readcommand at the end of the decryption process at step S3003. Since thisread command differs from the command numbers p to s set in the commandregister 2902 in the ascending order, the command number managingsection 2901 does not accept execution of the read command. Accordingly,the decrypted data resulting from the key exchange in the recordingdevice 400 cannot be read out by an external device, for example, therecording and reproducing device 300, thereby preventing key data orcontents from being illegally read out.

FIG. 31 shows part of the content reproducing process, previouslydescribed in FIG. 28, in which content is read out from the recordingdevice 400 and reproduced by the recording and reproducing device 300.Specifically, this process is executed at step S73 of FIG. 28.

In FIG. 31, at step S3101, the data (ex. the block information tableKbit and the content key Kcon), encrypted with the storage key Kstr, areread out from the external memory 402 of the recording device 400.

At step S3102, the data (ex. the block information table Kbit and thecontent key Kcon), read out from the memory of the recording device 400and encrypted with the storage key Kstr, are stored in the register. Atthis step, the recording and reproducing device 300 may read the dataencrypted with the storage key Kstr out from the external memory 402 ofthe recording device 400 and then store them in the register of therecording device 400.

At step S3103, the data (ex. the block information table Kbit and thecontent key Kcon), encrypted with the storage key Kstr, are taken outfrom the register and decrypted with the storage key Kstr.

At step S3104, the data (ex. the block information table Kbit and thecontent key Kcon), decrypted with the storage key Kstr, are encryptedwith the session key Kses.

The above process steps 3102 to 3104 correspond to processes included inthe command numbers u to y in the command register previously describedin FIG. 29. These processes are sequentially executed by the recordingdevice cryptography process section 406 in accordance with the commandnumbers u to y received by the command number managing section 2901 ofthe recording device from the recording and reproducing device 300.

At the next step S3105, the data (ex. the block information table Kbitand the content key Kcon) encrypted with the session key Kses aretransmitted from the recording device 400 to the recording andreproducing device 300.

The above described steps S3102 to S3104 constitute an uninterruptiblecontinuously-executed execution sequence. This is done even if, forexample, the recording and reproducing device 300 issues a data readcommand at the end of the decryption process at step S3103. Since thisread command differs from the command numbers u to y set in the commandregister 2902 in the ascending order, the command number managingsection 2901 does not accept execution of the read command. Accordingly,the decrypted data resulting from the key exchange in the recordingdevice 400 cannot be read out by an external device, for example, therecording and reproducing device 300, thereby preventing key data orcontents from being illegally read out.

For the process shown in FIGS. 30 and 31, the example is shown where theblock information table key Kbit and the content key Kcon are decryptedand encrypted by means of key exchange. These command sequences, storedin the command register 2902 (shown in FIG. 29), may include decryptionand encryption processes involving key exchanges for the content itself.The object to be decrypted or encrypted by means of key exchanges is notlimited to the above-described example.

The key exchange process after the mutual authentication in the presentdata processing apparatus has been described. Thus, the key exchangeprocess in the present data processing apparatus can be carried out onlyafter the authentication process between the recording and reproducingdevice 300 and the recording device 400 has been completed. Further,decrypted data can be prevented from being externally accessed duringthe key exchange process, thereby ensuring the improved security ofcontents and key data.

(10) Plural Content Data Formats and Download and Reproduction ProcessesCorresponding to Each Format

In the above-described embodiment, for example, the data format for themedium 500 or communication means 600 shown in FIG. 3 is of the typeshown in FIG. 4. The data format for the medium 500 or the communicationmeans 600 is not limited to the one shown in FIG. 4, but preferablydepends on the content (e.g., music, image data, a program such as agame, or the like). A plurality of data formats as well as processes fordownloading and reproducing data from and to the recording device 400will be explained.

FIGS. 32 to 35 show four different data formats. A data format used onthe medium 500 or the communication means 600 (shown in FIG. 3) is shownin the left of each figure, while a data format used in storing data inthe external memory 402 of the recording device 400 is shown in theright of each figure. An outline of the data formats shown in FIGS. 32to 35 will first be provided, and the contents of each data in eachformat and differences among data in each format will be explained.

FIG. 32 shows a format type 0, which is of the same type as that shownas an example in the above description. The format type 0 ischaracterized in that the entire data is divided into N data blocks eachhaving an arbitrary size. That is, blocks 1 to N, each of which isarbitrarily encrypted so that data can be configured by mixing togetherencrypted blocks and non-encrypted blocks (i.e., plain text blocks). Theblocks are encrypted with the content key Kcon, which is encrypted withthe distribution key Kdis on the medium 500 or with the storage key Kstrstored in the internal memory 405 of the recording device 400 when it isstored in the recording device 400. The block information key Kbit isalso encrypted with the distribution key Kdis on the medium 500 or withthe storage key Kstr stored in the internal memory 405 of the recordingdevice 400 when it is stored in the recording device 400. These keyexchanges are carried out in accordance with the process described in“(9) Key Exchange Process after Mutual Authentication.”

FIG. 33 shows a format type 1, in which the entire data is divided intoN data blocks. That is, blocks 1 to N, as in the format type 0, butwhich differ from the format type 0 in that the N blocks are all of thesame size. The aspect of the process for encrypting blocks with thecontent key Kcon is similar to that in the format type 0. Additionally,as in the above described format type 0, the content key Kcon and theblock information table key Kbit are encrypted with the distribution keyKdis on the medium 500 or with the storage key Kstr stored in theinternal memory 405 of the recording device 400 when it is stored in therecording device 400. Unlike the format type 0, the format type 1 has afixed block configuration to simplify configuration data such as datalength for each block, thereby enabling a memory size for blockinformation to be reduced compared to the format type 0.

In the example shown in FIG. 33, each block comprises a set of anencrypted part and a non-encrypted (plain text) part. If the length andconfiguration of the block are thus regular, each block length orconfiguration need not be checked during the decryption process or thelike, thereby enabling efficient decryption and encryption processes. Inthe format 1, the parts constituting each block, the encrypted part andthe non-encrypted (plain text) part, can each be defined as an object tobe checked, so that the content integrity check value ICVi is definedfor a block containing a part that must be checked.

FIG. 34 shows a format type 2. Format type 2 is characterized in thatthe data is divided into N data blocks all having the same size. Blocks1 to N are each encrypted with an individual block key Kblc. Each blockkey Kblc is encrypted with the content key Kcon. Kcon is encrypted withthe distribution key Kdis on the medium 500 or with the storage key Kstrstored in the internal memory 405 of the recording device 400 when it isstored in the recording device 400. The block information table key Kbitis also encrypted with the distribution key Kdis on the medium or withthe storage key Kstr stored in the internal memory of the recordingdevice when it is stored in the recording device.

FIG. 35 shows a format type 3. Format type 3 is characterized in thatthe data is divided into N data blocks all having the same size. Blocks1 to N, are each encrypted with an individual block key Kblc, as in theformat type 2. Each block key Kblc is encrypted with the distributionkey Kdis on the medium 500 or with the storage key Kstr on the recordingdevice 400, without the use of the content key. No content key Kcon ispresent on the medium 500 or on the device 400. The block informationtable key Kbit is encrypted with the distribution key Kdis on the medium500 or with the storage key Kstr stored in the internal memory 405 ofthe recording device 400 when it is stored in the recording device 400.

Next, the contents of the data in the above format types 0 to 3 will bedescribed. As previously described, the data are roughly divided intotwo sections, namely, the header section and the content section. Theheader section contains the content ID, the usage policy, the integritycheck values A and B, the total integrity check value, the blockinformation table key, the content key, and the block information table.

The usage policy stores the data length of content, its header length,its format type (formats 0 to 3 described below), and content typeindicating whether the content is a program or data. It also stores alocalization flag. The localization flag determines whether the contentcan be used only by a particular recording and reproducing device 300(as described in the section relating to the processes for downloadingand reproducing a content to and from the recording device 400). Theusage policy also stores a permission flag for a content copying ormoving process, and various localization and process information for thecontent (such as a content encryption algorithm and a mode).

The integrity check value A, ICVa, is used to check the content ID andthe usage policy. ICVa is generated using, for example, the methoddescribed in the above-described FIG. 23.

The block information table key Kbit is used to encrypt a blockinformation table. It is encrypted with the distribution key Kdis on themedium 500 or with the storage key Kstr stored in the internal memory405 of the recording device 400 when it is stored in the recordingdevice 400, as previously described.

The content key Kcon is used to encrypt content. For the format types 0and 1, it is encrypted with the distribution key Kdis on the medium 500or with the storage key Kstr stored in the internal memory 405 of therecording device 400 when it is stored in the recording device 400,similarly to the block information table key Kbit. For the format type2, the content key Kcon is also used to encrypt the block key Kblcconfigured for each content block. Additionally, for the format type 3,no content key Kcon is present.

The block information table describes information on the individualblocks and stores the size of each block and a flag indicating whetherthe block has been encrypted. That is, the block information tablestores information indicating whether or not the block is to be checked(ICV). If the block is to be checked, the block integrity check valueICVi (the integrity check value for the block i) is defined and storedin the table. This block information table is encrypted with the blockinformation table key Kbit.

If the block has been encrypted, the block integrity check value (thecontent integrity check value ICVi) is generated by exclusive-ORing theentire plain text (decrypted text) every 8 bytes, and then encryptingthe obtained value with the content-integrity-check-value-generating keyKicvc stored in the internal memory 307. Additionally, if the block hasnot been encrypted, the block integrity check value is generated bysequentially inputting the entire block data (plain text) to atamper-check-value-generating function shown in FIG. 36 (DES-CBC-MACusing the content-integrity-check-value-generating key Kicvc) in such amanner that 8 bytes are input each time. FIG. 36 shows an example of aconfiguration for generating the content block integrity check valueICVi. Each message M constitutes a set of 8 bytes of decrypted text dataor plain text data.

For the format type 1, if at least one of the parts in the block is datato be processed with the integrity check value ICVi, (that is, a part tobe checked), the content integrity check value ICVi is defined for thatblock. An integrity check value P-ICVij (for a part j of a block I) isgenerated by exclusive ORing the entire plain text (decrypted text)every 8 bytes and then encrypting the obtained data with thecontent-integrity-check-value-generating value Kicvc. In addition, if apart j has not bee encrypted, the integrity check value P-ICVij isgenerated by sequentially inputting the entire block data (plain text)to the tamper-check-value-generating function shown in FIG. 36(DES-CBC-MAC using the content-integrity-check-value-generating keyKicvc) in such a manner that 8 bytes are input each time.

Further, if the block i contains one part having [ICV flag=subject ofICV] indicating that it is to be checked, the integrity check valueP-ICVij generated using the above method is directly used as the blockintegrity check value ICVi. If the block i contains a plurality of partshaving [ICV flag=subject of ICV] indicating that they are to be checked,the integrity check value P-ICVij is generated by connecting a pluralityof parts integrity check values P-ICVij together in accordance with partnumbers to obtain data and sequentially inputting the entire data (plaindata) to the temper-check-value-generating function shown in FIG. 37(DES-CBC-MAC using the content-integrity-check-value-generating keyKicvc) in such a manner that 8 bytes are input each time. FIG. 37 showsan example of configuration for generating the content block contentintegrity check value ICVi.

The block integrity check value ICVi is not defined for the format types2 or 3.

The integrity check value B, ICVb, is used to check the blockinformation table key, the content key, and the entire block informationtable. It is generated using, for example, the method described in FIG.24.

The total integrity check value, ICVt, is used to check the entirety ofthe previously described ICVa and ICVb, and the integrity check valueICVi contained in each block of the content to be checked. ICVt isgenerated by applying the system signature key Ksys to the intermediateintegrity check value generated from each integrity check value, such asthe integrity check value ICVa, to execute the encryption process asdescribed in FIG. 25.

For the format types 2 and 3, the total integrity check value ICVt isgenerated by applying the system signature key Ksys to the intermediateintegrity check value generated by connecting the previously describedintegrity check values ICVa and ICVb to the content data (the entirecontent data between the block key in block 1 and the final block), toexecute the encryption process. FIG. 38 shows an example of aconfiguration for generating the total integrity check value ICVt forthe format types 2 and 3.

The unique integrity check value ICVdev is substituted with the totalintegrity check value ICVt if the previously described localization flagis set to 1. That is, it indicates that the content can be used only bya particular recording and reproducing device. For the format types 0and 1, the unique integrity check value ICVdev is generated to check thepreviously described integrity check values ICVa and ICVb and theintegrity check value ICVi contained in each block of the content to bechecked. Specifically, the unique integrity check value ICVdev isgenerated by applying the recording and reproducing device signature keyKdev to the intermediate integrity check value generated from theintegrity check values such as the integrity check value ICVa, asexplained in the description of FIG. 25 or 38.

Next, processes for downloading content of each of the format types 0 to3 from the recording and reproducing device 300 to the recording device400, and processes executed by the recording and reproducing device 300to reproduce a content of each of the format types 0 to 3 from therecording device 400, will be described with reference to the flowcharts in FIGS. 39 to 44.

First, the process for downloading content of the format type 0 or 1will be explained with reference to FIG. 39.

The process shown in FIG. 39 is started, for example, by installing therecording device 400 into the recording and reproducing device 300. Atstep S101, authentication is executed between the recording andreproducing device 300 and the recording device 400, and this step iscarried out in accordance with the authentication process flowpreviously described in FIG. 20.

If the authentication process at step S101 has been completed to set theauthentication flag, then at step S102, the recording and reproducingdevice 300 reads data of a predetermined format from the medium 500 viathe read section 304, the medium 500 storing content data, or uses thecommunication section 305 to receive data from the communication means600 in accordance with a predetermined format. Then, the control section301 of the recording and reproducing device 300 transmits the headersection of the data to the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300.

Next, at step S103, the control section 306 of the recording andreproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to calculate the integrity checkvalue A. The integrity check value A is calculated in accordance withthe ICV calculation method described in FIG. 7. It uses as a key theintegrity-check-value-A-generating key Kicva stored in the internalmemory 307 of the recording and reproducing device cryptography processsection 302. It uses the content ID and the usage policy as a message,as shown in FIG. 23. Then at step S104, the integrity check value A andthe check value ICVa stored in the header are compared together. If theyare equal, the process proceeds to step S105.

As previously described, the check value A, ICVa is used to verify thatthe content ID and the usage policy have not been tampered with. If theintegrity check value A calculated, for example, in accordance with theICV calculation, (using as a key the integrity-check-value-A-generatingkey Kicva stored in the internal memory 307 and using the content ID andthe usage policy as a message), equals the check value ICVa stored inthe header, it is determined that the content ID and the usage policyhave not been tampered with.

Next, at step S105, the control section 306 of the recording andreproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to obtain or generate thedistribution key Kdis. The distribution key Kdis is generated using, forexample, the master key MKdis for the distribution key, as in step S53in the previously described FIG. 22.

Then at step S106, the control section 306 of the recording andreproducing device cryptography process section 302 uses theencryption/decryption section 308 as well as the generated distributionkey Kdis, to decrypt the block information table key Kbit and contentkey Knon stored in the header section of the data obtained from themedium 500 via the read section 304 or received from the communicationmeans 600 via the communication section 305.

Further, at step S107, the control section 306 of the recording andreproducing device cryptography process section 302 uses theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to decrypt the block informationtable with the decrypted block information table key Kbit.

Further, at step S108, the control section 306 of the recording andreproducing device cryptography process section 302 calculates theintegrity check value B (ICVb′) from the block information table keyKbit, the content key Kcon, and the block information table (BIT). Theintegrity check value B is generated, as shown in FIG. 24, to decrypt anexclusive-ORed value based on the DES. This is done by using theintegrity-check-value-B-generating key Kicvb stored in the internalmemory 307. The exclusive-ORed value comprises the block informationtable key Kbit, the content key Kcon, and the block information table(BIT). Then at step S109, the ICVb′ and the ICVb in the header arecompared together, and if they are equal, the process proceeds to stepS110.

As previously described, the check value B, ICVb, is used to verify thatthe block information table key Kbit, the content key Kcon, and theblock information table have not been tampered with. If the integritycheck value B ICVb′ equals the check value ICVb stored in the header, itis determined that the block information table key Kbit, the content keyKcon, and the block information table have not been tampered with. Asdescribed earlier, ICVb′ is generated by using theintegrity-check-value-B-generating key Kicvb; dividing the blockinformation table key Kbit, the content key Kcon, and the blockinformation table (BIT) into 8-byte pieces; exclusive-ORing these data;and encrypting the exclusive-ORed data based on the DES.

At step S110, the control section 306 of the recording and reproducingdevice cryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the intermediate integrity check value. Theintermediate value is calculated in accordance with the ICV calculationmethod described in FIG. 7 or the like. This is done using thetotal-integrity-check-value-generating key Kicvt as a key and using theintegrity check values A and B and all the held content integrity checkvalues as a message. Kicvt is stored in the internal memory 307. Theintermediate integrity check value generated is stored in the recordingand reproducing device cryptography process section 302 of the recordingand reproducing device 300, as required.

Next, at step S111, the control section 306 of the recording andreproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to calculate the total integritycheck value ICVt′. As shown in FIG. 25, the total integrity check valueICVt is generated by using a system signature key Ksys as a key toencrypt the intermediate integrity check value based on the DES. Ksys isstored in the internal memory. Then at step S112, the total integritycheck value ICVt generated and the ICVt′ in the header stored at stepS112 are compared together, and if they are equal, the process proceedsto step S113.

As previously described in FIG. 4, the total integrity check value ICVtis used to verify that all of the integrity check values ICVa and ICVband the integrity check value for each content block have not beentampered with. Thus, if the total integrity check value generated bymeans of the above described process equals the integrity check valueICVt stored in the header, it is determined that all of the integritycheck values ICVa and ICVb and the integrity check value for eachcontent block have not been tampered with.

Then at step S113, the control section 301 of the recording andreproducing device 300 takes content block information out from theblock information table (BIT) and checks whether any content block is tobe verified. If any content block is to be verified, the contentintegrity check value has been stored in the block information in theheader.

If any content block is to be verified, then at step S114, the controlsection 301 reads this content block out from the medium 500 (using theread section 304 of the recording and reproducing device 300) orreceives it from the communicating means 600 (by using the communicationsection 305 of the recording and reproducing device 300), and transmitsthe content block to the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300. Onreceiving the content block, the control section 306 of the recordingand reproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to calculate the contentintegrity check value ICVi′.

If the block has been encrypted, the content integrity check value ICViis generated by decrypting the input content block in the DES CBC modeusing the content key Kcon Then it exclusive-ORs all of the decryptedtext every 8 bytes. And then it encrypts the generated contentintermediate value with the content-integrity-check-value-generating keyKicvc stored in the internal memory 307 of the recording and reproducingdevice 300. Additionally, if the block has not been encrypted, thecontent integrity check value is generated by sequentially inputting theentire block data (plain text) to the tamper-check-value-generatingfunction shown in FIG. 36 (DES-CBC-MAC using thecontent-integrity-check-value-generating key Kicvc) in such a mannerthat 8 bytes are input each time.

Then at step S115, the control section 306 of the recording andreproducing device cryptography process section 302 compares thiscontent integrity check value with the ICV in the content block receivedfrom the control section 301 of the recording and reproducing device 300at step S102. And it passes the result to the control section 301 of therecording and reproducing device 300. On receiving the result (and ifthe verification has been successful), the control section 301 of therecording and reproducing device 300 takes out the next content block tobe verified and causes the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 toverify this content block. Similar verification processes are repeateduntil all the content blocks are verified (step S116).

In this regard, if the check values are not equal at any of steps 104,109, 112, and 115, an error occurs to end the download process.

Then at step S117, the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 causesthe encryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to encrypt the block informationkey Kbit and content key Kcon decrypted at step S106. This is performedusing the session key Kses made sharable during the mutualauthentication. The control section 301 of the recording and reproducingdevice 300 reads the block information table key Kbit and the contentkey Kcon out from the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 and thentransmits them to the recording device 400 via the recording devicecontroller 303 of the recording and reproducing device 300.

Then at step S118, the recording device 400 causes theencryption/decryption section 406 of the recording device cryptographyprocess section 401 to decrypt the received data with the session keyKses (made sharable during the mutual authentication). Step 118 isperformed upon receiving the block information table key Kbit and thecontent key Kcon that is transmitted from the recording and reproducingdevice 300. The decrypted data in then reencrypted using the storage keyKstr, which is unique to the recording device which is stored in theinternal memory 405 of the recording device cryptography process 401.Then, the control section 301 of the recording and reproducing device300 reads the block information key Kbit and the content key Kcon outfrom the recording device 400 via the recording device controller 303 ofthe recording and reproducing device 300. The block information key Kbitand the content key Kcon can be reencrypted with the storage key Kstr.That is, the block information table key Kbit encrypted with thedistribution key Kdis is exchanged with the content key Kcon.

Then at step S119, the control section 301 of the recording andreproducing device 300 takes the localization field out from the usagepolicy in the header section of the data. This is done to determinewhether the downloaded content can be used only in this recording andreproducing device 300. If the localization field is set to 1, thedownloaded content can be used only by the recording and reproducingdevice 300. If the localization field is set to 0, the downloadedcontent can also be used by other similar recording and reproducingdevices 300. If the result of the determination shows that thelocalization field is set to 1, the process proceeds to step S120.

At step S120, the control section 301 of the recording and reproducingdevice 300 causes the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 tocalculate the integrity check value unique to the recording andreproducing device 300. The integrity check value unique to therecording and reproducing device 300 is generated by using as a key arecording and reproducing device signature key Kdev stored in theinternal memory 307 of the recording and reproducing device cryptographyprocess section 302. This is performed to encrypt the intermediateintegrity check value based on the DES. The intermediate integrity checkvalue can be generated at step S110. The calculated integrity checkvalue ICVdev unique to the recording and reproducing device 300substitutes for the total integrity check value ICVt.

As previously described, the system signature key Ksys is used to add acommon signature or ICV to the distribution system. The recording andreproducing device signature key Kdev varies depending on the recordingand reproducing device 300 and is used by the recording and reproducingdevice 300 to add a signature or ICV. That is, data signed with thesystem signature key Ksys is successfully checked by a system (recordingand reproducing device 300) having the same system signature key. Inother words, such data have the same total integrity check value ICVt soas to be sharable. If, however, data are signed with the recording andreproducing device signature key Kdev (since this signature key isunique to the recording and reproducing device) the data stored in arecording device after the signing cannot be reproduced if an attempt ismade to reproduce them after this recording device 400 has been insertedin another recording and reproducing device 300 In other words, an erroroccurs due to the unequal integrity check values ICVdev unique to therecording and reproducing device 300. In the data processing apparatusaccording to the present invention, the setting of the localizationfield enables content to be arbitrarily set so as to be sharedthroughout the entire system or used only by particular recording andreproducing devices 300.

Next, at step S121, the control section 301 of the recording andreproducing device 300 causes the recording and reproducing devicecryptography process section 302 to form a storage data format. Aspreviously described, one of the three format types, 0 to 3, is set inthe usage policy (see FIG. 5) in the header. This is done so that dataare formed in accordance with the storage format of one of thepreviously described FIGS. 32 to 35 depending on the set type. The flowshown in FIG. 39 is for the format 0 or 1, so that the data are formedinto one of the formats in FIGS. 32 and 33.

Once the storage data format has been completed at step S121, thecontrol section 301 of the recording and reproducing device 300 storesthe content in the external memory 402 of the recording device 400 atstep S122. How the process for downloading content data of the formattype 0 or 1 is carried out has been described.

The process for downloading content data of the format type 2 will beexplained with reference to FIG. 40. Differences from the abovedescribed process for downloading data of the format type 0 or 1 will befocused on.

Steps S101 to S109 are similar to the above described process fordownloading data of the format type 0 or 1, so description thereof isomitted.

Since the format type 2 has no content integrity check value ICVidefined therefor as previously described, the block information tablecontains no content integrity check value ICVi. The intermediateintegrity check value in the format type 2 is generated by applying thesystem signature key Ksys to the intermediate integrity check value(generated by connecting the integrity check values A and B to theentire content data between the leading data of the first block (theblock key in the block 1) and the final block), to execute theencryption process.

Thus, in the process for downloading data of the format type 2, thecontent data is read out at step S151. The intermediate integrity checkvalue is generated based on the integrity check values A and B and theread-out content data at step S152. In this regard, the content data isnot decrypted even if it has been encrypted.

For the format type 2, the processes for decrypting the block data andcollating the content integrity check values are omitted, contrary tothe previously described process for the format type 0 or 1, therebyincreasing the processing speed.

The processing at step S111 and subsequent steps is similar to that forthe format type 0 or 1, so description thereof is omitted.

How the process for downloading content data of the format type 2 iscarried out has been described. As described above, the process fordownloading data of the format type 2 omits the processes for decryptingthe block data and collating the content integrity check values contraryto the process for the format type 0 or 1, thereby increasing theprocessing speed. This format is thus suitable for processing of musicdata or the like which must be executed in real time.

Next, the process for downloading content data of format type 3 will bedescribed with reference to FIG. 41. The following description willfocus on differences from the above described download process for theformat types 0, 1, and 2.

Steps S101 to S105 are similar to those of the above described downloadprocess for the format types 0, 1, and 2, so description thereof isomitted.

The process for the format type 3 essentially has many characteristicsin common with that for the format type 2, but differs therefrom in thatthe format type 3 has no content key in that the block key Kblc isstored in the recording device 400 after encryption with the storage keyKstr.

The following description will focus on the differences between thedownload process for the format type 3 and that for the format type 2.With the format type 3, at step S161 (which follows step S105), theblock information table key is decrypted. The control section 306 of therecording and reproducing device cryptography process section 302 usesthe encryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302, as well as the distribution keyKdis generated at step S105, to decrypt the block information table keyKbit. Kbit is stored in the header section of the data obtained from themedium 500 via the read section 304, or received from the communicationmeans 600 via the communication section 305. With the format type 3,data contains no content key Kcon, so that the process for decryptingthe content key Kcon is not executed.

At the next step S107, the block information table key Kbit (decryptedat step S161) is used to decrypt the block information table. At stepS162, the control section 306 of the recording and reproducing devicecryptography process section 302 generates integrity check valueB(ICVb′) from the block information table key Kbit and block informationtable (BIT). The integrity check value B is generated by using theintegrity-check-value-B-generating key Kicvb. This is performed toencrypt the exclusive-ORed value comprising the block information tablekey Kbit and block information table (BIT), based on the DES. Kicvb isstored in the internal memory 307. Next, at step S109, the integritycheck value B (ICVb) and the ICVb in the header are compared together.If they are equal, the process proceeds to step S151.

With the format type 3, the check value B, ICVb functions to verify thatthe block information table key Kbit and the block information tablehave not been tampered with. If the integrity check value B generatedequals the check value ICVb stored in the header, it is determined thatthe block information table key Kbit and the block information tablehave not been tampered with.

Steps S151 to S112 are similar to those of the process for the formattype 2, and description thereof is omitted.

At step S163, the block key Kblc, contained in the content data read outat step S151, is decrypted with the distribution key Kdis generated atstep S105.

Then at step S164, the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 causesthe encryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to encrypt the block informationkey Kbit (decrypted at step S161) and the block key Kblock (decrypted atstep S163), using the session key Kses made sharable during the mutualauthentication. The control section 301 of the recording and reproducingdevice 300 reads the block information table key Kbit and the block keyKblc out from the recording and reproducing device cryptography processsection 302 of the recording and reproducing device 300 and thentransmits this data to the recording device 400 via the recording devicecontroller 303 of the recording and reproducing device 300.

Then at step S165, the recording device 400 causes theencryption/decryption section 406 of the recording device cryptographyprocess section 401 to decrypt the received data with the session keyKses. Step 165 occurs upon receiving the block information table keyKbit and the block key Kblc that are transmitted from the recording andreproducing device 300. Kses was made sharable during the mutualauthentication. The decrypted data is then reencrypted using the storagekey Kstr which is unique to the recording device 400 which is stored inthe internal memory 405 of the recording device cryptography process401. The control section 301 of the recording and reproducing device 300reads the block information table key Kbit and the block key Kblcreencrypted by a storage key Kstr from the recording device 400 via therecording device controller of the recording and reproducing device 300.That is, the block information table key Kbit and block key Kblcinitially encrypted with the distribution key Kdis are replaced with theblock information table key Kbit and block key Kblc reencrypted with thestorage key Kstr.

The subsequent steps S119 to S122 are similar to those for the formattypes 0, 1, and 2, so description thereof is omitted.

The aspect of the process for downloading content data of the formattype 3 has been described. As described above, the download process forthe format type 3 omits the decryption of the block data and the processfor collating the content integrity check value as for the format type2, thereby enabling prompt processing. The format type 3 is thussuitable for processing data such as music data, which requiresreal-time processing. In addition, since the range within which theencrypted content is protected is localized by the block key Kblc,advanced security is achieved compared to the format type 2.

Next, processes for reproducing data of each of the format types 0 to 3from the recording device 400 will be explained with reference to theflow charts in FIGS. 42 to 45.

First, a process for reproducing content of the format type 0 will beexplained with reference to FIG. 42.

Step S201 corresponds to an authentication process between the recordingand reproducing device 300 and the recording device 400. It is executedin accordance with the authentication process flow previously describedin FIG. 20.

Once the authentication process at step S201 has been completed to setthe authentication flag, the recording and reproducing device 300, atstep S202, reads the header of data of a predetermined format out fromthe recording device 400 and transmits it to the recording andreproducing device cryptography process section 302 of the recording andreproducing device 300.

Then at step S203, the control section 306 of the recording andreproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to calculate the integrity checkvalue A. The integrity check value A, IVCa′, is calculated using as akey the integrity-check-value-A-generating key Kicva stored in theinternal memory 307 of the recording and reproducing device cryptographyprocess section 302 and using the content ID and the usage policy as amessage, as shown in the previously described FIG. 23. Then, theintegrity check value A, IVCa′, and the check value ICVa stored in theheader are compared together at step S204. If they are equal, theprocess proceeds to step S205.

The check value A, ICVa, is used to verify that the content ID and theusage policy have not been tampered with. If the calculated integritycheck value A, IVCa′, equals the check value ICVa stored in the header,it is determined that the content ID and the usage policy have not beentampered with.

Then at step S205, the control section 301 of the recording andreproducing device 300 takes out, from the read-out header section, theblock information table key Kbit and content key Kcon (encrypted withthe storage key Kstr unique to the recording device) and then transmitsthem to the recording device 400 via the recording device controller 303of the recording and reproducing device 300.

On receiving the block information table key Kbit and the content keyKcon (transmitted from the recording and reproducing device 300), therecording device 400 causes the encryption/decryption section 406 of therecording device cryptography process section 401 to decrypt thereceived data with the storage key Kstr (unique to the recording devicewhich is stored in the internal memory 405 of the recording devicecryptography process) and to then reencrypt the decrypted data using thesession key Kses (made sharable during the mutual authentication). Thisprocess is as previously described in detail in (9) Key Exchange Processafter Mutual Authentication.

At step S206, the control section 301 of the recording and reproducingdevice 300 receives the block information table key Kbit and content keyKcon reencrypted with the session key Kses, from the recording device400, via the recording device controller 303 of the recording andreproducing device 300.

Then at step S207, the control section 301 of the recording andreproducing device 300 transmits the received block information tablekey Kbit and content key Kcon (which are reencrypted with the sessionkey Kses), to the recording and reproducing device cryptography processsection 302 of the recording and reproducing device 300. On receivingthe block information table key Kbit and content key Kcon reencryptedwith the session key Kses the content block, the cryptography processsection 302 of the recording and reproducing device 300 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to decrypt these keys Kbit andKcon with the session key Kses (made sharable during the mutualauthentication).

Further at step S208, the decrypted block information table key Kbit isused to decrypt the block information read out at step S202. Therecording and reproducing device cryptography process section 302 of therecording and reproducing device 300 replaces the decrypted blockinformation table key Kbit, content key Kcon, and block informationtable BIT with the block information table key Kbit, content key Kcon,and block information table BIT contained in the header read out at stepS202, to hold the latter. Additionally, the control section 301 of therecording and reproducing device 300 reads the decrypted blockinformation table BIT out from the recording and reproducing devicecryptography process section 302 of the recording and reproducing device300.

Further, at step S209, the control section 306 of the recording andreproducing device cryptography process section 302 generates theintegrity check value B(ICVb′) from the block information table keyKbit, the content key Kcon, and the block information table (BIT). Theintegrity check value B is generated, as shown in FIG. 24, by using as akey the integrity-check-value-B-generating key Kicvb to decrypt theexclusive-ORed value comprising the block information table key Kbit,the content key Kcon, and the block information table (BIT), based onthe DES. Kicvb is stored in the internal memory 307. Then at step S210,the integrity check value B, ICVb′, and the ICVb in the header arecompared together. If they are equal, the process proceeds to step S211.

The check value B, ICVb is used to verify that the block informationtable key Kbit, the content key Kcon, and the block information tablehave not been tampered with. If the integrity check value B generatedequals the check value ICVb stored in the header, it is determined thatthe block information table key Kbit, the content key Kcon, and theblock information table stored in the recording device 400 have not beentampered with.

At step S211, the control section 306 of the recording and reproducingdevice cryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the intermediate integrity check value. Theintermediate value is calculated in accordance with the ICV calculationmethod described in FIG. 7, using the total-integrity-check-valuegenerating key Kicvt as a key. Kicvt is stored in the internal memory307 of the recording and reproducing device cryptography process section302. The integrity check values A and B in the verified header and allthe content integrity check values in the block information table areused as a message, as shown in FIG. 25. In this regard, the intermediateintegrity check value generated is stored in the recording andreproducing device cryptography process section 302 of the recording andreproducing device 300 as required.

Next, at step S212, the control section 301 of the recording andreproducing device 300 takes the localization field out from the usagepolicy to determine whether the content to be reproduced can be usedonly by this recording and reproducing device 300 (in this case, thelocalization field is set to 1) or also by other similar recording andreproducing devices 300 (in this case, the localization field is set to0). The usage policy is contained in the header section of the data readfrom the external memory 402. If the result of the determination showsthat the localization field is set to 1, that is, the reproduced contentcan be used only by this recording and reproducing device 300, theprocess proceeds to step S213. If the localization field is set to 0,that is, the reproduced content can also be used by other similarrecording and reproducing devices 300, the process proceeds to stepS215. The processing at step S211 may be executed by the cryptographyprocess section 302.

At step S213, the control section 301 of the recording and reproducingdevice 300 causes the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300 tocalculate the integrity check value ICVdev′. ICVdev′ is unique to therecording and reproducing device 300. The integrity check value ICVdev′,unique to the recording and reproducing device, is generated as shown inFIG. 25, by using a recording and reproducing device signature key Kdevas a key to decrypt the intermediate integrity check value based on theDES. The intermediate integrity check value can be held at step S58.Kdev is stored in the internal memory 307.

Then at step S214, the integrity check value ICVdev′ (unique to therecording and reproducing device 300) calculated at step S213, and theICVdev in the header read out at step S202, are compared together. Ifthey are equal, the process proceeds to step S217.

At step S215, the control section 306 of the recording and reproducingdevice cryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the total integrity check value ICVt. The totalintegrity check value ICVt′ is generated by using the system signaturekey Ksys as a key to decrypt the intermediate integrity check valuebased on the DES, as shown in FIG. 25. Ksys is stored in the internalmemory 307. Then at step S216, the generated total integrity check valueICVt′ and the ICVt in the header are compared together. If they areequal, the process proceeds to step S217.

The total integrity check value ICVt and the integrity check valueICVdev unique to the recording and reproducing device are used to verifythat all of the integrity check values ICVa and ICVb and the integritycheck value for each content block have not been tampered with. Thus, ifthe total integrity check value generated by means of the abovedescribed process equals the integrity check value: ICVt or ICVdevstored in the header, it is determined that all of the integrity checkvalues for each content block have not been tampered.

Next, at step S217, the control section 301 of the recording andreproducing device 300 reads the block data out from the recordingdevice 400. Furthermore, at step S218, it is determined whether or notthe data has been encrypted. If the data has been encrypted, thecryptography process section 302 of the recording and reproducing device300 decrypts the block data. If the data has not been encrypted, theprocess skips step S219 and advances to step S220.

Then at step S220, the control section 301 of the recording andreproducing device 300 checks whether any content block is to beverified. This is done based on the content block information table inthe block information table (BIT). If any content block is to beverified, the content integrity check value has been stored in the blockinformation in the header. In this case, the content integrity checkvalue ICVi for this content block is calculated at step S221. If nocontent block is to be verified, the process skips steps S221 and S222to advance to step S223.

If the block has been encrypted as previously described in FIG. 36, thecontent integrity check value ICVi′ is generated by decrypting the inputcontent block with the content key Kcon in the DES CBC mode,exclusive-ORing all of the results every 8 bytes to generate the contentintermediate value. Then the process encrypts the obtained value withthe content-integrity-check-value-generating key Kicvc (stored in theinternal memory 307 of the recording and reproducing device 300).Additionally, if the block has not been encrypted, the content integritycheck value is generated by sequentially inputting the entire data(plain text) to the tamper-check-value-generating function shown in FIG.36 (DES-CBC-MAC using the content-integrity-check-value-generating keyKicvc) in such a manner that 8 bytes are input each time.

At step S222, the control section 306 of the recording and reproducingdevice cryptography process section 302 compares the generated contentintegrity check value ICVi′ with the ICVi stored in the content blockreceived from the recording device 400 at step S202, and passes theresult to the control section 301 of the recording and reproducingdevice 300. On receiving the result (and if the verification has beensuccessful), the content plain data for execution (reproduction) on theRAM of the recording and reproducing device system is formed at stepS223. The control section 301 of the recording and reproducing device300 takes out the next content block to be verified and causes therecording and reproducing device cryptography process section 302 of therecording and reproducing device 300 to verify this content block.Similar verification processes and RAM storage processes are repeateduntil all the content blocks are verified (step S224).

If the check values do not match at any of steps S204, S210, S214, S216,or S222, an error occurs to end the reproduction process.

When it is determined at step S224 that all the blocks have been readout, the process proceeds to step S225 to start executing andreproducing the content (program or data).

The aspect of the process for reproducing content data of the formattype 0 has been explained.

Next, the process for downloading content data of the format type 1 willbe explained with reference to FIG. 43. The following description willfocus on differences from the above described download process for theformat type 0.

The processing from steps S201 to S217 is similar to that in the abovedescribed download process for the format type 0, so description thereofis omitted.

For the format type 1, at step S231, encrypted parts are decrypted togenerate a part ICV. Further at step S232, the block ICVi′ is generated.As previously described with the format type 1, if at least one of theparts in a block contains data to be verified with the integrity checkvalue ICVi, the content integrity check value ICVi is defined for thisblock. For example, if the part j has been encrypted, an integrity checkvalue P-ICVij for a part j of a block i is generated by exclusive-ORingthe entire plain text (decrypted text) every 8 bytes and decrypting theobtained value with the content-integrity-check-value-generating keyKicvc. Additionally, if the part j has not been encrypted, the integritycheck value P-ICVij is generated by sequentially inputting the entiredata (plain text) to the tamper-check-value-generating function shown inFIG. 36 (DES-CBC-MAC using the content-integrity-check-value-generatingkey Kicvc) in such a manner that 8 bytes are input each time.

Further, if the block i contains only one part having [ICV flag=subjectof ICV] indicating that it is to be checked, the integrity check-valueP-ICVij generated using the above method is directly used as the blockintegrity check value ICVi. If the block i contains a plurality of partshaving [ICV flag=subject of ICV] indicating that they are to be checked,the integrity check value P-ICVij is generated by connecting a pluralityof part integrity check values P-ICVij together in accordance with partnumbers to obtain data. and the process then sequentially inputs theentire data (plain text) to the tamper-check-value-generating functionshown in FIG. 36 (DES-CBC-MAC using thecontent-integrity-check-value-generating key Kicvc) in such a mannerthat 8 bytes are input each time. This is the same as explained in FIG.37.

For the format type 1, the content integrity check value generated bymeans of the above described procedure undergoes comparison at stepS222. Processing at the next step S223 and the subsequent steps issimilar to that for the format type 0, so description thereof isomitted.

Next, the process for reproducing content data of the format type 2 willbe explained with reference to FIG. 44. The following description willfocus on differences from the above described reproduction processes forthe format types 0 and 2.

Steps S201 to S210 are similar to that in the above-describedreproduction processes for the format types 0 and 1, so descriptionthereof is omitted.

For the format type 2, the processing at steps S211 to S216, which isexecuted for the format types 0 and 1, is not executed. In addition, theformat type 2 has no content integrity check value, so that verificationof the content integrity check value, which is executed for the formattypes 0 and 1, is not executed.

In the data reproduction process for the format type 2 (performed afterstep S210 for verifying the integrity check value B), the processproceeds to step S217, where the block data are read out under thecontrol of the control section 301 of the recording and reproducingdevice 300. Further, at step S241, the cryptography process section 306of the recording and reproducing device 300 decrypts the block key Kblccontained in the block data. The block key Kblc, stored in the recordingdevice 400, has been encrypted with the content key Kcon as shown inFIG. 34. Kblc is thus decrypted with the content key Kcon decrypted,which has been decrypted at step S207.

Then at step S242, the block key Kblc (decrypted at step S241) is usedto decrypt the block data. Furthermore, at step S243, the content(program or data) is executed and reproduced. The processing from stepsS217 to S243 is repeated for all the blocks. When it is determined atstep S244 that all the blocks have been read out, the reproductionprocess is ended.

As described above, the process for the format type 2 omits the processfor verifying the integrity check value, such as the total integritycheck value. It thus provides a configuration suitable for executing thedecryption process at a high speed, and a format suitable for processingdata such as music data which requires real-time processing.

Next, the process for reproducing content data of format type 3 will bedescribed with reference to FIG. 45. The following description willfocus on differences from the above described reproduction process forthe format types 0, 1, and 2.

The process for the format type 3 essentially has many characteristicsin common with that for the format type 2. Format type 3 differstherefrom in that, as described in FIG. 35, the format type 3 has nocontent key. The block key Kblc is stored in the recording device 400after encryption with the storage key Kstr.

Between steps S201 and S210, processing at steps S251, S252, S253, andS254 is configured to omit the use of the content key, which is contraryto the corresponding processing for the formats 0, 1, and 2.

At step S251, the control section 301 of the recording and reproducingdevice 300 takes out, from the read-out header, the block informationtable key Kbit and then transmits this key to the recording device 400.This is done via the recording device controller 303 of the recordingand reproducing device 300. Kbit is encrypted with the storage key Kstrunique to the recording device 400.

On receiving the block information table key Kbit transmitted from therecording and reproducing device 300, the recording device 400 causesthe encryption/decryption section 406 of the recording devicecryptography process section 401 to decrypt the received data with thestorage key Kstr and to then reencrypt the decrypted data using thesession key Kses. Kses is unique to the recording device 400, and isstored in the internal memory 405 of the recording device cryptographyprocess section 401. Kses is made sharable during mutual authentication.This process is as previously described in detail in (9) Key ExchangeProcess after Mutual Authentication.

At step S252, the control section 301 of the recording and reproducingdevice 300 receives the block information table key Kbit (reencryptedwith the session key Kses), from the recording device 400. Kbit isreceived via the recording device controller 303 of the recording andreproducing device 300.

Then at step S253, the control section 301 of the recording andreproducing device 300 transmits the received block information tablekey Kbit (reencrypted with the session key Kses), to the recording andreproducing device cryptography process section 302 of the recording andreproducing device 300. On receiving the block information table keyKbit (reencrypted with the session key Kses the content block), therecording and reproducing device cryptography process section 302 of therecording and reproducing device 300 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to decrypt this block information table key Kbit with thesession key Kses.

Further at step S208, the decrypted block information table key Kbit isused to decrypt the block information read out at step S202. Therecording and reproducing device cryptography process section 302 of therecording and reproducing device 300 replaces the decrypted blockinformation table key Kbit and block information table BIT with theblock information table key Kbit and block information table BIT,contained in the header read out at step S202, to hold the latter.Additionally, the control section 301 of the recording and reproducingdevice 300 reads the decrypted block information table BIT out from therecording and reproducing device cryptography process section 302 of therecording and reproducing device 300.

Further, at step S254, the control section 306 of the recording andreproducing device cryptography process section 302 generates theintegrity check value B(ICVb′) from the block information table key Kbitand the block information table (BIT). The integrity check value B,ICVb′, is generated, as shown in FIG. 24, by using as a key theintegrity-check-value-B-generating key Kicvb to decrypt theexclusive-ORed value comprising the block information table key Kbit andthe block information table (BIT), based on the DES. Kicvb is stored inthe internal memory 307 of the recording and reproducing devicecryptography process section 302. Then at step S210, the integrity checkvalue B, ICVb′, and the ICVb in the header are compared together, and ifthey are equal, the process proceeds to step S211.

With the format type 3, the block key is further encrypted with thestorage key when stored in the recording device 400, thereby requiringthe recording device 400 to execute a decryption processes with thestorage key and the session key Kses. It also requires the recording andreproducing device 300 to execute a decryption process with the sessionkey. This series of steps corresponds to the process steps shown assteps S255 and S256.

At step S255, the control section 301 of the recording and reproducingdevice 300 takes out, from the read-out header, the block key Kblc(encrypted with the storage key Kstr, which is unique to the recordingdevice that has been read out at step S217) and then transmits this keyto the recording device 400 via the recording device controller 303 ofthe recording and reproducing device 300.

On receiving the block key Kblc transmitted from the recording andreproducing device 300, the recording device 400 causes theencryption/decryption section 406 of the recording device cryptographyprocess section 401 to decrypt the received data with the storage keyKstr. It then reencrypts the decrypted data using the session key Ksesthat was made sharable during the mutual authentication. Kstr is uniqueto the recording device which is stored in the internal memory 405 ofthe recording device cryptography process section 401. This process isas previously described in detail in (9) Key Exchange Process afterMutual Authentication.

At step S256, the control section 301 of the recording and reproducingdevice 300 receives the block key Kblc (reencrypted with the session keyKses), from the recording device 400 via the recording device controller303 of the recording and reproducing device 300.

Then, at step S257, the cryptography process section 306 of therecording and reproducing device 300 decrypts the block key Kblc usingthe session key Kses.

Then at step S242, the block key Kblc, decrypted at step S257, is usedto decrypt the block data. Furthermore, at step S243, the content(program or data) is executed and reproduced. The processing from stepsS217 to S243 is repeated for all the blocks. When it is determined atstep S244 that all the blocks have been read out, the reproductionprocess is ended.

The process for reproducing a content of the format type 3 has beendescribed. The format type 3 is similar to the format type 2 in that theprocess for verifying the total integrity check value is omitted.However, format type 3 provides a processing configuration with a highersecurity level due to the inclusion of the process for exchanging theblock key Kblc.

(11) Process Executed by Content Provider to Generate Integrity CheckValue (ICV)

In the above described embodiments, the verification processes with thevarious integrity check values ICV are executed during downloading orreproducing content. Aspects of the process for generating the integritycheck values ICV and the verification process will be described below.

First, each of the integrity check values explained in the embodimentswill be described in brief. The following integrity check values, ICV,are used in the data processing apparatus according to the presentinvention.

Integrity check value A, ICVa is the integrity check value for verifyingthat the content ID and usage policy in the content data have not beentampered with.

Integrity check value B, ICVb is the integrity check value for verifyingthat the block information table key Kbit, the content key Kcon, and theblock information table have not been tampered with.

Content integrity check value ICVi is the integrity check value forverifying that each content block of the content has not been tamperedwith.

Total integrity check value ICVt is the integrity check value forverifying that the integrity check value ICVa, the integrity check valueICVb, and all the integrity check values for the content blocks have notbeen tampered with.

Integrity check value ICVdev, unique to the recording and reproducingdevice 300 is the integrity check value that is replaced with the totalintegrity check value ICVt if the localization flag is set to 1. Thatis, the content can be used only by a particular recording andreproducing device 300. It is generated as an integrity check value forthe previously described integrity check value A, ICVa, integrity checkvalue B, ICVb, and integrity check value ICVi contained in each block ofthe content to be checked.

Depending on the format, the integrity check values ICVt and ICVdevcheck the content itself, not the check value for each content block.

Each of the above integrity check values is used in the data processingapparatus according to the present invention. Of these integrity checkvalues, the integrity check values A (IVCa) and B (IVCb), the totalintegrity check value (IVCt), and the content integrity check value aregenerated by a content provider (for providing content data) or acontent manager (based on data to be verified), as shown, for example,in FIGS. 32 to 35 and 6. They are stored in the data together with thecontent before being provided to a user of the recording and reproducingdevice 300. When downloading or reproducing the content to or from therecording device, the user of the recording and reproducing device 300(i.e., the content user) generates verifying ICVs (based on each data tobe verified), to compare them with the stored ICVs. Additionally, theintegrity check value ICVdev, unique to the reproducing device 400, isreplaced with the total integrity check value ICVt. It is then stored inthe recording device 400 if it is shown that the content can be usedonly by this recording and reproducing device 300.

In the above-described embodiments, the processes for generating theintegrity check values are principally based on the DES-CBC. The presentinvention, however, is not limited to the above-described method, butincludes various ICV-generating and verifying process aspects. Inparticular, for the relationship between the content provider or managerand the content user, the following various ICV-generating and verifyingprocess configurations are possible.

FIGS. 46 to 48 are views illustrating a generation process executed by agenerator of the integrity check value ICV and a verification processexecuted by a verifier.

FIG. 46 shows a configuration wherein, for example, an ICV generator(who is a content provider or manager) executes the process forgenerating the ICV based on the DES-CBC as described in the aboveembodiments. It then provides the generated ICV to a recording andreproducing device user, that is, a verifier together with the content.In this case, for the verification process, the recording andreproducing device user requires the keys stored in the internal memory307 (shown in FIG. 18) for generating the corresponding integrity checkvalues. The verifier (recording and reproducing device user) who is thecontent user uses the integrity-check-value-generating key stored in theinternal memory 307 to apply the DES-CBC to data to be verified in orderto generate the integrity check values. It then compares these valueswith stored integrity check values. In this case, eachintegrity-check-value-generating key is configured so as to be secretlyshared by the ICV creator and the verifier.

FIG. 47 shows a configuration wherein the ICV creator (who is thecontent provider or manager) generates ICVs using a digital signature ofa public key cryptosystem and then provides the generated ICVs to thecontent user. The content user stores the public key of the ICV creatorand uses this key to verify the ICVs. In this case, the public key ofthe ICV creator, which is held by the content user (recording andreproducing device user), need not be secret this results in easiermanagement. This aspect is thus suitable for ICV generation andmanagement executed at a high security management level, for example,that executed in one entity.

In FIG. 48, the ICV creator (who is the content provider or manager)generates ICVs using a digital signature of a public key cryptosystem.It then provides the generated ICVs to the content user together withthe content; further stores a public key in a public key certificate(see, for example, FIG. 14); and then provides this key to the recordingand reproducing device user. With a plurality of ICV creators, eachcreator has a key managing center create data (a public key certificate)for certifying the validity of the public key.

The content user (the ICV verifier) has a public key of the key managingcenter. The IVC verifier verifies the public key certificate using thepublic key of the key managing center, and, if its validity has beenascertained, takes out the public key of the ICV creator stored in thepublic key certificate. The verifier further verifies the ICVs using thetaken-out public key of the ICV creator.

This method is useful if a plurality of ICV creators are present and ifa center for managing these creators has an established managementsystem.

(12) Configuration for Generating Cryptography Process Keys Based onMaster Keys

A configuration for generating various cryptography process keys basedon the master keys will be described below.

As previously described with reference to FIG. 18, the internal memory307 of the recording and reproducing device 300 in the present dataprocessing apparatus stores the various master keys. Each of the variousmaster keys which can be used, for example, to generate theauthentication key Kate (see Equation 3) or the distribution key Kdis(see Equation 4).

When cryptography communication, mutual authentication, MAC generation,verification, or the like is carried out between two entities, theseentities conventionally hold secret information common to them, such as,key information. The entities may be, for example, the content provider,the recording and reproducing device 300 and the recording device 400 inthe present data processing apparatus. Additionally, when the aboveprocess is carried out between one and many entities, (for example, onecontent provider and many content users, or one recording andreproducing device and many recording media) these entitiesconventionally store and hold secret information common to all theentities. That is, secret information common to many content users ormany recording media, or one content provider individually manages anduses secret information (ex. key) for each of many content users.

With the one-to-many relationship as described above, however, theconfiguration owning secret information (key) shared by all the entitiesis disadvantageous in that leakage of the secret from one entity affectsall the other entities using the same secret information (ex. key). Inaddition, when one manager, such as a content provider individuallymanages and uses secret information for each content user, a list isrequired that serves to identify all the users and that associates thisidentification data with unique secret information (ex. keys). Thisincreases list maintaining and managing burdens in proportion to thenumber of users.

The data processing apparatus according to the present invention hassolved a problem with sharing secret information between entities usinga configuration for holding the master keys and generating variousindividual keys therefrom. This configuration will be described below.

In the data processing apparatus according to the present invention, ifdifferent individual keys are required for various cryptographyprocesses, authentication processes, and the like between recordingdevices, media storing contents, or recording and reproducing devices,these individual keys are generated using individual information such asidentifier data (ID) unique to the devices or media and anindividual-key generating method (previously determined in the recordingand reproducing device 300). With this configuration, if any individualkey generated should be identified, damage to the entire system can beprecluded by preventing the corresponding master key from leaking. Inaddition, the configuration for generating the keys from the master keyseliminates the needs for the association list.

A specific example of configuration will be described with reference tothe drawings. FIG. 49 illustrates a configuration for generating variouskeys using the various master keys held by the recording and reproducingdevice 300. The medium 500 and the communication means 600 input contentas in the already described embodiments. The content is encrypted by thecontent key Kcon, which is in turn encrypted by the distribution keyKdis.

For example, if the recording and reproducing device 300 attempts totake a content out from the medium 500 or the communication means 600and download it to the recording device 400, the recording andreproducing device 300 must obtain the distribution key Kdis that hasencrypted the content key as previously described in FIGS. 2 and 39 to41. Although the key Kdis can be directly obtained from the medium 500or the communication means 600 or the recording and reproducing device300 can obtain and store it in its memory beforehand, the configurationfor distributing such a key to many users may be subjected to leakage,which may affect the entire system, as described above.

The data processing system according to the present invention isconfigured to generate the distribution key Kdis by applying a masterkey MKdis for the distribution key stored in the memory of the recordingand reproducing device 300 as well as a process based on the content ID.That is, Kdis=DES (MKdis, content ID), as shown in the lower part ofFIG. 49. In a content distributing configuration between a contentprovider providing contents from the medium 500 or the communicationmeans 600 and the recording and reproducing device 300 (where recordingand reproducing device 300 is a content user), despite a large number ofcontent providers, this configuration enables advanced security to bemaintained without the need to distribute the individual distributionkeys Kdis via the medium 500, the communication means 600 or the like,or to store them in each recording and reproducing device 300.

Next, the generation of the authentication key Kaka will be explained.In downloading a content from the recording and reproducing device 300to the recording medium 400 (as previously described in FIGS. 22 and 39to 41), or causing the recording and reproducing device 300 to executeand reproduce a content stored in the recording medium 400 (as describedin FIGS. 42 to 45), the recording and reproducing device 300 and therecording medium 400 must execute the mutual authentication process (seeFIG. 20).

As described in FIG. 20, this authentication process requires therecording and reproducing device 300 to have the authentication keyKake. Although the recording and reproducing device 300 can obtain theauthentication key directly from, for example, the recording medium 400or can obtain and store it in its memory beforehand, the configurationfor distributing such a key to many users may be subjected to leakage.Leakage may affect the entire system, as in the above-describedconfiguration for the distribution key.

The data processing system according to the present invention isconfigured to obtain the authentication key Kake by applying a masterkey MKake for the distribution key stored in the memory of the recordingand reproducing device 300, as well as a process based on the recordingdevice ID: IDmem. That is, Kake=DES (MKake, IDmem), as shown in thelower part of FIG. 49.

Further, in downloading content from the recording and reproducingdevice 300 to the recording medium 400 (as previously described in FIGS.22 and 39 to 41) or causing the recording and reproducing device 300 toexecute and reproduce content stored in the recording medium 400 (asdescribed in FIG. 28, FIGS. 42 to 45), a configuration similar to thatfor the distribution or authentication key described above can be usedfor the recording and reproducing device signature key Kdev that isrequired to generate the integrity check value ICVdev unique to therecording and reproducing device 300 if the content can be used only bya particular recording and reproducing device 300. In the abovedescribed embodiments, the recording and reproducing device signaturekey Kdev is stored in the internal memory. However, if the master keyMkdev for the recording and reproducing device signature key is storedin the memory whereas the recording and reproducing device signature keyKdev is not stored therein, and if the recording and reproducing devicesignature key Kdev is obtained by means of Kdes=DES (MKdev, IDdev) basedon the recording and reproducing device identifier Iddev, and the masterkey MKdev for the recording and reproducing device signature key, asrequired (as shown in the lower part of FIG. 49), then it advantageouslybecomes unnecessary for each apparatus to have the recording andreproducing device signature key Kdev.

In this manner, the data processing apparatus according to the presentinvention is configured to sequentially generate information from themaster keys and each ID. The information is, for example, a key which isrequired for the cryptography information process between two entities.The entities may be, by way of example, the provider and the recordingand reproducing device 300, or the recording and reproducing device 300and the recording device 400. Consequently, even if the key informationleaks from each entity, the range of damage incurred by the individualkeys is further limited. It also becomes unnecessary to manage key listsfor the individual entities as described above.

A plurality of examples of processes relating to this configuration willbe explained with flowcharts. FIG. 50 shows examples of a processexecuted by the content producer or manager to decrypt content or thelike using a master key. FIG. 50 also illustrates process executed by auser device (for example, the recording and reproducing device 300 inthe above described embodiment) to decrypt the encrypted data using themaster key.

At step S501, a content producer or manager imparts an identifier(content identifier) to content. At step S502, the content producer ormanager generates a key for encrypting content or the like, based on itsowned master key and a content ID. At this step, if the distribution keyKdis is to be generated, it is generated based on the above-describedKdis=DES (MKdis, medium ID). Then at step S503, the content producer ormanager uses a key (for example, the distribution key Kdis) to encryptpart or all of the content stored in the medium. The content producersupplies the content encrypted through these steps, via the medium 500such as a DVD, the communication means 600, or the like.

At step S504, a user device (such as the recording and reproducingdevice 300) reads the content ID from the content data received via themedium 500 such as a DVD, the communication means 600, or the like. Thenat step S505, the user device generates a key applied to decryption ofthe encrypted content based on the read-out medium ID and its ownedmaster key. If the distribution key Kdis is to be obtained, thisgeneration process corresponds to, for example, the distribution keyKdis=DES (MKdis, medium ID). At step S506, the user device uses this keyto decrypt the content. At step S507, the user device reproduces thedecrypted device content or execute the program.

In this example, as shown in the lower part of FIG. 50, both the contentproducer or manager and the user device have the master key (forexample, the distribution-key-generating master key MKdis) tosequentially generate the distribution key required to encrypt ordecrypt the content based on their owned master key and each ID (mediumID).

With this system, if the distribution key leaks to a third person, thethird person can decrypt that content. However, content stored in othermedia 500 with different content IDs can be prevented from decryption.This thereby minimizes the adverse effects of the leakage of one contentkey on the entire system. Additionally, this system does not require theuser device (that is, the recording and reproducing device 300) to holda key associating list for each medium 500.

An example where the content producer or manager holds a plurality ofmaster keys to execute a process depending on a content distributiondestination is provided with reference to FIGS. 51-52.

In FIG. 51, step S511, executed by the content producer or manager,comprises imparting an identifier (content ID) to the content. Step S512comprises selecting one of a plurality of master keys (for example, aplurality of distribution-key-generating master keys MKdis) held by thecontent producer or manager. Although described in further detail withreference to FIG. 52, this selection process comprises setting anapplied master key beforehand for each of the countries to which contentusers belong, each apparatus type, or each apparatus version, andexecuting the master keys in accordance with the settings.

Then at step S513, the content producer or manager generates anencryption key based on the master key selected at step S512 and thecontent ID determined at step S511. If, for example, the distributionkey Kdis is to be generated, it is generated based on the abovedescribed Kdis=DES (MKdis, medium ID). Then at step S514, the contentproducer or manager uses a key (for example, the distribution key Kdisi)to encrypt part or all of the content stored in the medium. At stepS515, the content producer distributes the encrypted content via themedium 500 such as a DVD, the communication means 600, or the like,using a distribution unit. The distribution unit comprises the contentID, the master-key-generating information used and the encryptedcontent.

On the other hand, at step S516, for example, the user device (such as arecording and reproducing device 300) determines whether or not itsholds the master key corresponding the master key ID in the content datadistributed by the medium 500 (such as a DVD) or by the communicationmeans 600. If it does not have the master key corresponding to themaster key ID in the content data, the distributed content cannot beused by this user device and the process is ended.

If the user device has the master key corresponding to the master key IDin the content data, then at step S517 it reads the content ID out fromthe content data received via the medium 500, the communication means600, or the like. Then at step S518, the user device generates a keyapplied to decryption of the encrypted content based on the read-outcontent ID and its held master key. This process is a distribution-keyKdisi=DES (Mkdisi, contents ID) if it intends to get a distribution keyKdisi. At step S519, content is decrypted by means of the Kdisi key. Atstep S520 decrypted contents are used.

In this example, as shown in the lower part of FIG. 51, the contentproducer or manager has a master key set comprising a plurality ofmaster keys. The master key set includes, for example,distribution-key-generating master keys MKdis 1 to N. On the other hand,the user device has one master key. For example, the user device has onedistribution-key-generating master key MKdisi so that it can decrypt thecontent only when the content producer or manager has used the keyMKdisi for the encryption.

FIG. 52 shows an example where master keys vary depending on thecountry, as a specific example of the aspect shown in the flow in FIG.51. The content provider has master keys MK1 to MKN, of which the keyMK1 is used to generate keys for encrypting content distributed to userdevices for Japan. For example, an encryption key K1 is generated from acontent ID and the key MK1 and then used to encrypt content. The masterkeys MK1 to MKN are further set such that the key MK2 is used togenerate keys for encrypting content distributed to user devices for theU.S., and the key MK3 is used to generate keys for encrypting contentdistributed to user devices for the EU (Europe).

For user devices for Japan, for instance, recording and reproducingdevices 300 such as PCs or game apparatuses which are sold in Japan, themaster key MK1 is stored in their internal memories, for user devicesfor the U.S., the master key MK2 is stored in their internal memories307, and for user devices for the EU, the master key MK3 is stored intheir internal memories 307.

With this configuration, the content provider selectively uses one ofthe master keys MK1 to MKN depending on user devices that can use onecontent, in order to encrypt the content to be distributed to the userdevices. For example, to allow the content to be used only by the userdevices for Japan, the master key K1 (generated using the master keyMK1) is used to encrypt the content. This encrypted content can bedecrypted using the master key MK1 stored in the user devices for Japan.That is, MK1 allows a decryption key to be generated. In contrast, thekey K1 cannot be obtained from the master keys MK2 and MK3 (stored inthe user devices for the U.S. and EU, respectively), thereby preventingthe encrypted content from being decrypted.

In this manner, the content provider can selectively use a plurality ofmaster keys to set localization for various content. FIG. 52 shows anexample where the different master keys are used for the differentcountries to which the user devices belong, but various use forms arepossible. For example, the master key can be switched depending on thetype of the user device or its version, as described above.

Next, FIG. 53 shows an example of a process where an identifier uniqueto a medium 500, (i.e., a medium ID) and a master key are combinedtogether. Here, the medium 500 refers to, for example, DVDs or CDs inwhich content is stored. The medium ID may be unique to individual media500, the titles of contents such as movies, or individual mediummanufacturing lots. In this manner, medium IDs may be assigned invarious manners.

At step S521, a medium producer or manager determines an identifier(medium identifier) for a medium 500. At step S522, the medium produceror manager generates a key for encrypting content stored in the medium500 based on its owned master key and a medium ID. At this step, if, forexample, the distribution key Kdis is to be generated, it is generatedbased on the above described Kdis=DES (MKdis, medium ID). Then at stepS523, the medium producer or manager uses a key (for example, thedistribution key Kdis) to encrypt part or all of the content stored inthe medium 500. The medium producer supplies, through these steps themedium 500 storing the content encrypted.

On the other hand, at step S524, a user device such as the recording andreproducing device 300 reads the medium ID from the supplied medium 500.Then at step S525, the user device generates a key applied to decryptionof the encrypted content based on the read-out medium ID and its ownedmaster key. If the distribution key Kdis is to be obtained, thisgeneration process corresponds to, for example, the distribution keyKdis=DES (MKdis, medium ID). At step S526, the user device uses this keyto decrypt the content. At step S527, the user device uses the content.That is, the user device reproduces the decrypted content or executesthe program.

In this example, as shown in the lower part of FIG. 53, both the mediumproducer or manager and the user device have the master key (forexample, the distribution-key-generating master key MKdis) tosequentially generate the distribution key required to encrypt ordecrypt the content based on their owned master key and each ID (mediumID).

With this system, if any medium key leaks to a third person, the thirdperson can decrypt the content in the medium 500, but content stored inother media 500 with different medium IDs can be prevented fromdecryption. This minimizes the adverse effects of the leakage of onemedium key on the entire system. Additionally, this system does notrequire the user device, that is, the recording and reproducing device300, to hold a key associating list for each medium 500. Further, thesize of content encrypted with one medium key is limited to a capacitythat can be stored within that medium 500, so that there is a slimpossibility that the content reaches the amount of information requiredto attack the encrypted text. This further reduces the possibility ofdecrypting the encrypted text.

Next, FIG. 54 shows an example of a process where an identifier uniqueto the recording and reproducing device 300, and a master key arecombined together.

At step S531, a recording and reproducing device user generates a keyfor encrypting content or the like based on a master key and a recordingand reproducing device ID. This information can be stored, for example,in the internal memory 307 of the recording and reproducing device 300.If, for example, the content key Kcon is to be obtained, this generationprocess corresponds to Kcon=DES (MKcon, recording and reproducing deviceID). Then at step S532, the user uses a key (form example, thedistribution key Kcon) to decrypt the content. At step S533, the userstores the encrypted content in the recording and reproducing device300, such as a hard disk.

On the other hand, when the recording and reproducing device user thathas stored the content requests the stored data to be recovered, asystem manager for managing the recording and reproducing device 300reads a recording and reproducing device ID from the recording andreproducing device in step S534. Then at step S535, the system managergenerates a key applied to recovery of the encrypted content, based onthe read-out recording and reproducing device ID and its owned masterkey. If the content key Kcon is to be obtained, this generation processcorresponds to, for example, the content key Kcon=DES (MKcon, recordingand reproducing device ID). At step S536, the user device uses this keyto decrypt the content.

In this example, as shown in the lower part of FIG. 54, both therecording and reproducing device user and the system manager have themaster key (for example, the content-key-generating master key MKcon) tosequentially generate the distribution key required to encrypt ordecrypt the content based on their owned master key and each ID(recording and reproducing device ID).

With this system, if the content key leaks to a third person, the thirdperson can decrypt that content, but content stored in other media 500with different recording and reproducing device IDs can be preventedfrom decryption. This minimizes the adverse effects of the leakage ofone content key on the entire system. Additionally, this system does notrequire the system manager or the user device to hold a key associatinglist for each medium 500.

FIG. 55 shows a configuration wherein an authentication key used for amutual authentication process between a slave device, (for example, therecording device 400, such as a memory card) and a host device, (forexample, the recording and reproducing device 300) is generated based ona master key. Although in the previously described authenticationprocess (see FIG. 20), the authentication key is stored in the internalmemory 405 of the slave device in advance, it can be generated duringthe authentication process based on the master key as shown in FIG. 55.

For example, at step S541, the slave device that is the recording device400 generates, as an initialization process before starting theauthentication process, the authentication key Kake. Kake is for use inthe mutual authentication process based on the master key and slavedevice ID stored in the internal memory 105 of the slave device that isthe recording device 400. The authentication key is generated based onKake=DES (MKake, slave device ID). Then at step S542, the generatedauthentication key is stored in the memory.

On the other hand, at step S543, the host device such as the recordingand reproducing device 300, reads a slave device ID out from theinstalled recording device 400 (that is, the slave device), via thecommunication means. Then at step S544, the host device generates aauthentication key applied to a mutual authentication process based onthe read-out slave device ID and its owned authentication-key-generatingmaster key. This generation process corresponds to, for example, theauthentication key Kake=DES (MKake, slave device ID). At step S545, thisauthentication key is used to execute the authentication process.

In this example, as shown in the lower part of FIG. 55, both the slavedevice and the master device have the master key (that is, theauthentication-key-generating master key Mkake) to sequentially generatethe distribution key required for the authentication process based ontheir owned master key and the slave device ID.

With this system, if the authentication key leaks to a third person,this authentication key is effective only on the corresponding slavedevice and authentication is not established with other slave devices,thereby minimizing the adverse effects of the leakage of the key.

As described above, the data processing apparatus according to thepresent invention is configured so that the information such as the keywhich is required for the procedure for the cryptography informationprocess between the two entities such as the content provider and therecording and reproducing device, or the recording and reproducingdevice and the recording device. Thus, even if the key information leaksfrom each entity, the range of damage incurred by the individual keys isfurther limited. It also becomes unnecessary to manage key lists for theindividual entities as described above.

(13) Control of Cryptography Intensity in Cryptography Process

In the above described embodiments, the cryptography process between therecording and reproducing device 300 and the recording device 400 isprincipally described in conjunction with the example using thecryptography process based on the single DES configuration describedwith reference to FIG. 7. The encryption process method applied to thepresent data processing apparatus is not limited to the above describedSingle DES. Any encryption method may be employed depending on arequired security state.

For example, the Triple DES method, configured as shown in thepreviously described FIGS. 8 to 10, is applicable. For example, both thecryptography process section 302 of the recording and reproducing device300 and the cryptography process section 401 of the recording device 400shown in FIG. 3 can be configured so as to execute the Triple DES methodso that a process can be executed which corresponds to the cryptographyprocess based on the Triple DES method described in FIGS. 8 to 10.

The content provider, however, may give top priority to processing speed(dependent on the content) to use a 64-bit content key Kcon based on theSingle DES method, or give top priority to security to use a 128- or192-bit content key Kcon based on the Triple DES method. Accordingly, itis not preferable to configure the cryptography process section 302 ofthe recording and reproducing device 300 and the cryptography processsection 401 of the recording device 400 so as to accommodate only one ofthe Triple and Single DES methods. Therefore, the cryptography processsection 302 of the recording and reproducing device 300 and thecryptography process section 401 of the recording device 400 aredesirably configured so as to accommodate both the Triple and Single DESmethods.

However, to configure the cryptography process section 302 of therecording and reproducing device 300 and the cryptography processsection 401 of the recording device 400 so as to execute both the Tripleand Single DES methods, different circuits and logics must be configuredfor these cryptography process sections. For example, to allow therecording device 400 to execute a process corresponding to the TripleDES, a command set for the Triple DES must be stored in the commandregister as shown in FIG. 29. This may complicate the process sectionconfigured in the recording device 400.

Thus, for the present data processing apparatus, a configuration isproposed wherein the logic of the cryptography process section 401 ofthe recording device 400 is configured to accommodate the Single DES,while executing a process corresponding to the Triple DES process tostore data (keys, contents, or the like) encrypted based on the TripleDES method, in the external memory 402 of the recording device 400.

For example, for the data format type 0 shown in FIG. 32, when contentdata is downloaded from the recording and reproducing device 300 to therecording device 400, the authentication process is executed at stepS101 in FIG. 39 (showing the flow of downloading data of the format type0), and the session key Kses is generated. Further, at step S117, thecryptography process section 302 of the recording and reproducing device300 encrypts the content key Kcon with the session key Kses. It thentransmits the encrypted key to the recording device 400 via thecommunication means 600. At step S118, the cryptography process section403 of the recording device 400 (which has received the encrypted key)decrypts the content key Kcon with the session key Kses. Cryptographyprocess section 403 then further encrypts it with the storage key Kstr,and transmits the resulting key to the cryptography process section 302.The recording and reproducing device 300 subsequently forms a dataformat (step S121). It transmits formatted data to the recording device400. The recording device 400 stores the received data in the externalmemory 402.

If the cryptography process executed between steps S117 and S118 of theabove process (by the cryptography process section 401 of the recordingdevice 400) is configured to selectively execute either the Single orTriple DES method, the cryptography process section 401 works whetherthe content provider provides content data using the content key Kcon inaccordance with the Triple DES or the Single DES.

FIG. 56 illustrates a configuration for executing the cryptographyprocess method in accordance with the Triple DES method. This is doneusing both the cryptography process section 302 of the recording andreproducing device 300 and the cryptography process section 401 of therecording device 400. FIG. 56 shows an example of a process forencrypting the content key Kcon with the storage key Kstr. The processis executed in downloading content data from the recording andreproducing device 300 to the recording device 400. The content key Kconis based on the Triple DES method. Here, the example of the process forthe content key Kcon is shown, but other keys or other data, such ascontent, can be similarly processed.

The Triple DES method uses two or three keys in such a manner that a64-bit key is used for the Single DES, while a 128- or 192-bit key isused for the Triple DES, as previously described in FIGS. 8 to 10. Thesethree content keys Kcon are referred to as Kcon1, Kcon2, and (Kcon3) or,alternatively, Kc1, Kc2 and (Kc3) as shown in FIG. 56. The Kcon3 isshown in the parentheses because it may not be used.

The process in FIG. 56 will be explained as follows. At step S301, themutual authentication process is carried out between the recording andreproducing device 300 and the recording device 400. This mutualauthentication process step is executed during the process as in thepreviously described FIG. 20. During this authentication process, thesession key Kses is generated.

Once the authentication process at step S301 has been completed, theintegrity check values ICV (including the integrity check values A andB, the content integrity check value, and the total integrity checkvalue) are collated.

When all the check values, ICV, have been collated, and it has beendetermined that no data have been tampered with, the process proceeds tostep S303. In step S303, the control section 306 of the recording andreproducing device cryptography process section 302 uses theencryption/decryption section 308, as well as the previously obtained orgenerated distribution key Kdis, to decrypt the content Kcon. Kcon maybe stored in the header section of the data obtained from the medium500, or received from the communication means 600 via the communicationsection 305. The content key in this case is a triple DES type key, suchas content keys Kcon1, Kcon2, and (Kcon3).

Then at step S304, the control section 306 of the recording andreproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to encrypt only the content keyKcon1 of the content keys Kcon1, Kcon2, and (Kcon3) decrypted at stepS303. This is done using the session key Kses made sharable during themutual authentication.

The control section 301 of the recording and reproducing device 300reads data containing the content key Kcon1 (encrypted with the sessionkey Kses). The data is read out from the recording and reproducingdevice cryptography process section 302 of the recording and reproducingdevice 300. The control section 301 then transmits this data to therecording device 400 via the recording device controller 303 of therecording and reproducing device 300.

Then at step S305 (on receiving the content key Kcon1 transmitted fromthe recording and reproducing device 300), the recording device 400causes the encryption/decryption section 406 of the recording devicecryptography process section 401 to decrypt the received content keyKcon1 using the session key Kses. Kses was made sharable during themutual authentication. Further at step S306, the recording device 400causes the encryption/decryption section 406 to reencrypt the decryptedcontent key with the storage key Kstr. Kstr is unique to the recordingdevice 400. It is stored in the internal memory 405 of the recordingdevice cryptography process. The recording device 400 then transmits thereencrypted key to the recording and reproducing device 300 via thecommunication section 404.

Then at step S307, the control section 306 of the recording andreproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to encrypt only the content keyKcon2 of the content keys Kcon1, Kcon2, and (Kcon3). This is done usingthe session key Kses, which was made sharable during the mutualauthentication.

The control section 301 of the recording and reproducing device 300reads data containing the content key Kcon2 encrypted with the sessionkey Kses, out from the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300. Thecontrol section 301 then transmits this data to the recording device 400via the recording device controller 303 of the recording and reproducingdevice 300.

Then at step S308, on receiving the content key Kcon2 transmitted fromthe recording and reproducing device 300, the recording device 400causes the encryption/decryption section 406 of the recording devicecryptography process section 401 to decrypt the received content keyKcon2. It is decrypted using the session key Kses, which was madesharable during the mutual authentication. Further at step S309, therecording device 400 causes the encryption/decryption section 406 toreencrypt the decrypted content key with the storage key Kstr. Kstr isunique to the recording device, and is stored in the internal memory 405of the recording device cryptography process section 401. Recordingdevice 400 then transmits the reencrypted key to the recording andreproducing device 300 via the communication section 404.

Then at step S310, the control section 306 of the recording andreproducing device cryptography process section 302 causes theencryption/decryption section 308 of the recording and reproducingdevice cryptography process section 302 to encrypt only the content keyKcon3 of the content keys Kcon1, Kcon2, and (Kcon3). This is performedusing the session key Kses, which was made sharable during the mutualauthentication.

The control section 301 of the recording and reproducing device 300reads data containing the content key Kcon3 (encrypted with the sessionkey Kses) out from the recording and reproducing device cryptographyprocess section 302 of the recording and reproducing device 300. Thecontrol section 301 then transmits this data to the recording device 400via the recording device controller 303 of the recording and reproducingdevice 300.

Then at step S311, the recording device 400 causes theencryption/decryption section 4060 of the recording device cryptographyprocess section 401 to decrypt the received content key Kcon3 using thesession key Kses. This is done on receiving the content key Kcon3 thatis transmitted from the recording and reproducing device 300. Further,at step S312, the recording device 400 causes the encryption/decryptionsection 406 to reencrypt the decrypted content key with the storage keyKstr. Kstr is unique to the recording device, and is stored in theinternal memory 405 of the recording device cryptography process.Recording device 400 then transmits the reencrypted key to the recordingand reproducing device 300 via the communication section 404.

Then at step S313, the cryptography process section of the recording andreproducing device 300 forms the various data formats described in FIGS.32 to 35 and transmits them to the recording device 400.

Finally, at step S314, the recording device 400 stores the receivedformatted data in the external memory 402. This format data contains thecontent keys Kcon1, Kcon2, and (Kcon3) that were encrypted with thestorage key Kstr.

This process enables the content keys stored in the recording device 400to be stored as keys based on the Triple DES cryptosystem. If only twocontent keys Kcon1 and Kcon2 are used, the processing from steps S310 toS312 is omitted.

As described above, the recording device 400 can store the keys with theTriple DES applied thereto in the memory by repeating processing of thesame aspect. That is, the process steps S305 and S306 can be performedplural times with only the target changed. If the Single DES is appliedto the content keys Kcon, steps S305 and S306 may be executed to carryout the formatting process at step S313 before storing the keys in thememory. Such a configuration may store commands for executing theprocessing at steps S305 and S306 in the command register, as in thepreviously described FIG. 29, and execute this processing one to threetimes depending on the aspect of the key. That is, repeating theprocessing depends upon whether the key is based on the Triple or SingleDES method. Accordingly, the processes based on both the Triple andSingle DES methods can be executed without containing the Triple DESprocess method in the process logic of the recording device 400. In thisregard, the cryptosystem may be recorded in the usage policy in theheader section of the content data so as to be determined by referencingthe usage policy.

(14) Program Activation Process Based on Activation Priority in UsagePolicy in Content Data

As understood from the content data configurations in the previouslydescribed FIGS. 4 to 6, the usage policy stored in the header section ofthe content data used in the present data processing apparatus containsthe content type and the activation priority. With a plurality ofaccessible content data recorded in various recording media 500 such asthe recording device 400, a DVD, a CD, a hard disk, or a game cartridge,the recording and reproducing device 300 in the present data processingapparatus determines the order in which these contents are activated, inaccordance with the activation priority.

The recording and reproducing device 300 executes the mutualauthentication with various recording devices 400, such as a DVD device,a CD drive device, and a hard disk drive device. Recording andreproducing device 300 then executes the program in the content datawith the top priority in accordance with the priority in the contentdata. The “Program Activation Process Based on Activation Priority inUsage Policy in Content Data” will be explained below.

The above description of the present data processing apparatus focuseson the process executed if the recording and reproducing device 300reproduces and executes content data from one recording device 400.However, the recording and reproducing device 300 is generallyconfigured so as to access, in addition to the recording device 400, aDVD, a CD, and a hard disk via the read section 304 as well as recordingmedia 500 (such as a memory card and a game cartridge) that areconnected via the PIO 111 or SIO 112. In FIG. 2, only one read section304 is described in order to avoid complicating the drawing. Therecording and reproducing device 300 can have different recording media500, for example, a DVD, a CD, a floppy disk, and a hard disk, installedtherein in parallel.

The recording and reproducing device 300 can access a plurality ofrecording media 500, each of which store content data. Content datasupplied by an external content provider, such as a CD, are stored inthe medium 500 in the data configuration shown in the previouslydescribed FIG. 4 or in each recording medium 500 (such as a memory card)in the content data configuration shown in FIG. 26 or 27, if the dataare taken out from the medium 500 or downloaded via the communicationmeans 600. Furthermore, the content data is stored on the medium 500 andthe recording device 400 in different formats depending on the formattype thereof, as shown in FIGS. 32 to 35. In either case, the usagepolicy in the header of the content data contains the content type andthe activation priority.

A process executed by the recording and reproducing device 300, toactivate content if a plurality of content data is accessible, will beexplained in accordance with the FIG. 57.

FIG. 57 shows a process flow showing an example (1) of a process wherethere is a plurality of content that can be activated. At step S611,recording devices 400 that are accessible to the recording andreproducing device 300 are authenticated. The accessible recordingdevices 400 include a memory card, a DVD device, a CD drive, a hard discdevice, and a game cartridge or the like. They are connected, forexample, via the parallel I/O, PIO 111, or the serial I/O, SIO 112, asshown in FIG. 2. Each recording device is authenticated under thecontrol of the control section 301 shown in FIG. 2, for example, inaccordance with the procedure previously explained in FIG. 20.

Next, at step S612, programs that can be activated are detected from thecontent data stored in the memory of the successfully authenticatedrecording device 400. Specifically, this is executed as a process ofextracting content for which the content type contained in the usagepolicy of the content data indicates a program.

Then at step S613, the priority of the program that can be activated andwhich has been extracted at step S612 is determined. Step S613 selectsthe top priority. Specifically, this corresponds to a process ofcomparing the priorities contained in the usage policies in the headersof the plurality of content data that can be activated in step S612.

Then at step S614, the selected program is activated. If the pluralityof programs that can be activated have the same priority, defaultpriorities are set for the recording devices 400 so that the contentprogram stored in the device with the top priority is executed.

FIG. 58 shows an example (2) of a process where identifiers are set fora plurality of recording devices 400 so that the authentication and theretrieval of a content program are sequentially executed for therecording devices 400 with the identifiers. That is, FIG. 58 illustratesa process for a plurality of content that can be activated.

At step S621, recording devices 400 (i) installed in the recording andreproducing device 300 are authenticated. A plurality of (n) recordingdevices 400 are sequentially imparted with identifiers 1 to n.

At step S622, it is determined whether or not the authentication at stepS621 has been successful. If so, the process proceeds to step S623,where programs that can be activated are retrieved from the recordingmedia of the recording devices 400 (i). If the authentication hasfailed, the process proceeds to step S627 where it is determined whetheror not there is a new recording device 400 from which content can beretrieved. Without such a recording device 400, the process is ended.Otherwise, the process advances to step S628 to update the recordingdevice identifier i and repeat step S621 and the subsequentauthentication process steps.

At step S623, programs that can be activated are detected from thecontent data stored in the recording devices 400 (i). Specifically, thisis executed as a process of extracting content for which the contenttype contained in the usage policy of the content data indicates aprogram.

At step S624, it is determined whether or not the content (of which thecontent type is a program) has been extracted. If such content has beenextracted, one of the extracted programs which has the top priority isselected at step S625, and the selected program is executed at stepS626.

If it is determined at step S624 that no content (of which the contenttype is a program) has been extracted, the process proceeds to step S627to determine whether or not there is a new recording device 400 fromwhich content can be retrieved. Without such a recording device 400, theprocess is ended. Otherwise, the process proceeds to step S628 to updatethe recording device identifier i and repeat step S621 and thesubsequent authentication process steps.

FIG. 59 illustrates an example of a process for a plurality of contentthat can be activated. At step S651, recording devices 400 that areaccessible to the recording and reproducing device 300 areauthenticated. For instance, an accessible DVD device, CD drive, harddisc device, and game cartridge or the like are authenticated. Eachrecording device 400 is authenticated under the control of the controlsection 301 (shown in FIG. 2). This is done, for example, in accordancewith the procedure previously explained in FIG. 20.

Next, at step S652, programs that can be activated are detected from thecontent data stored in the memory of the successfully authenticatedrecording device 400. Specifically, this is executed as a process ofextracting content for which the content type (contained in the usagepolicy of the content data) indicates a program.

Then at step S653, information (such as the name of the program that canbe activated and which has been extracted at step S652) is displayed ona display means. Although the display means is not shown in FIG. 2, AVoutput data are output to the display means (not shown). User providedinformation, such as a program name for each content data, is stored inthe content ID of the content data. This is done so that programinformation (such as a program name for each authenticated content data)is output to the output means via the control section 301 that is underthe control of the main CPU 106 shown in FIG. 2.

Then at step S654, the main CPU 106 receives the user's programselection input from the input means. The input means can be the inputinterface, controller, mouse, or keyboard shown in FIG. 2. Input occursvia the interface 110. At step S655, the user selected program isexecuted in accordance with the selection input.

As described above, in the data processing apparatus according to thepresent invention, the program activation priority is stored in theusage policy (which is in the header of the content data) so that therecording and reproducing device 300 activates programs in accordancewith this priority. Alternatively, the display means can displayactivated program information from which the user can select a desiredprogram. This configuration eliminates the need for the user to retrieveprograms, saving the amount of time and labor required for theactivation. Additionally, the programs that can be activated areactivated after all the recording devices 400 have been authenticated orare shown to be such programs. This thereby eliminates the complexity ofthe process, such as the need to validate a program after selection.

(15) Content Configuring and Reproducing (Decompressing) Process

In the data processing apparatus according to the present invention, therecording and reproducing device 300 downloads content from the medium500 or the communication means 600, or reproduces data from therecording device 400, as described above. The above description focuseson the processing of encrypted data associated with the downloading orreproduction of content.

The control section 301 of the recording and reproducing device 300 inFIG. 3 generally controls the authentication, encryption, and decryptionprocesses associated with the downloading or reproduction of contentdata from the device 500, the communication means 600, or the recordingdevice.

Reproducible contents resulting from these processes are, for example,sound data, image data or the like. Decrypted data from the controlsection 301 is placed under the control of the main CPU (shown in FIG.2) and output to the AV output section, depending on the sound or imagedata. If, the content is, for example, sound data that has beenMP3-compressed, an MP3 decoder in the AV output section (shown in FIG.2) decrypts and outputs the sound data. If the content data includesimages that have been MPEG2-compressed, an MP2 decoder in the AV outputsection decompresses and outputs the image data. In this manner, thedata contained in the content data may have or have not been compressed(encoded). The data is output after being processed depending on thecontent.

However, due to various types of compression and decompression processprograms, even if the content provider provides compressed data, thisdata cannot be reproduced without a corresponding decompression processexecuting program.

Thus, the present invention discloses a data processing apparatuswherein compressed data and a decryption (decompression) process programtherefor are stored in data content. Alternatively, link information forthe compressed data and the decryption (decompression) process programtherefor is stored as header information in the content data.

FIG. 60 is a view obtained by simplifying elements from the general viewof data processing shown in FIG. 2, which relate to the presentconfiguration. The recording and reproducing device 300 receives variouscontent from the device 500 (such as a DVD or a CD), the communicationmeans 600, or the recording device 400 (such as a memory card, whichstores content). This content can include various data such as sounddata, still images, animated image data, and program data which has orhas not been encrypted or compressed.

If the received content has been encrypted, the decryption process isexecuted using a method such as that described above and based on thecontrol of the control section 301 and the cryptography process ofcryptography process section 302. The decrypted data is transferred tothe AV process section 109 under the control of the CPU 106, where thedata are stored in a memory 3090 of the AV process section 109. Then, acontent analysis section 3091 analyzes the configuration of the content.If, for example, a data decompressing program is stored in the content,it is stored in a program storage section 3093. If, the content containssound, image data or the like, this data are stored in a data storagesection 3092. A decompression process section 3094 uses a decompressionprocess program, such as MP3 (which is stored in the program storagesection), to decompress compressed data stored in the data storagesection 3092. The data is then output to speakers 3001 or a monitor3002.

Next, some examples of configurations of data received by the AV processsection 109 (via the control section 301) and of relevant processes willbe explained. Here, sound data will be shown as an example of content.Content with the MP3 applied thereto will be described as arepresentative compression program. This configuration, however, isapplicable to image data as well as sound data. Various programs forMPEG2 or MPEG4 can be applied thereto instead of MP3.

FIG. 61 shows an example of the configuration of content. This figureshows sound data 6102 compressed by means of the MP3, and a MP3decryption (decompression) process program 6101. Sound data 6102 and MP3decryption process program 6101 are integrated together into one contentblock. Such content blocks are each stored in the medium 500 or therecording device 400, and are distributed from the communication means600 as a single content block. If these content blocks have beenencrypted as previously described, the recording and reproducing device300 uses the cryptography process section 303 to decrypt the content andthen transfers it to the AV process section 109.

The content analysis section 3091 of the AV process section 109 analyzesthe received content, takes a sound data decompression program (MP3decoder) section out from the content, and stores it in the programstorage section 3093. The sound data decompression program comprises asound data decompression program (MP3 decoder) section and a compressedsound data section. The compressed sound data is stored in the datastorage section 3092. The content analysis section 3091 may receiveinformation such as a content name or content configuration informationin addition to the content or it may analyze the content based onidentification data such as a data name, or other data such as a datalength or a data configuration, which are all contained in the content.Then, a compression and decompression process section 3094 decompressesthe MP3-compressed sound data stored in the data storage section 3092 inaccordance with the sound data decompression program (MP3 decoder)(stored in the program storage section 3093). The AV process section 109then outputs the decompressed sound data to the speakers 3001.

FIG. 62 shows an example of a process for reproducing data of thecontent configuration in FIG. 61. At step S671, a data name stored inthe memory 3090 of the AV process section 109 (for example, informationsuch as the title of music present if the content is sound data) istaken out from the information received separately from the content, orfrom data in the content, and is then displayed on the monitor 3002. Atstep S672, the user's selection is received from one of the variousinput means, such as the switches and the keyboard via the inputinterface 110. A reproduction process command, based on user input data,is then output to the AV process section 109, which is under the controlof the CPU 106. At step S673, the AV process section 109 extract anddecompress data selected by the user.

Next, FIG. 63 shows an example of a configuration wherein the contentcontains either compressed sound data or the decompression processprogram. It also contains content information indicating what thecontent contains, such as header information for each content.

As shown in FIG. 63, if the content is a program 6202, the contentcontains as header information 6201, content identification informationindicating that this is a program and that the type of program is to beMP3-decompressed. On the other hand, if sound data 6204 is contained ascontent, the content information in the header 6203 indicates that thedata has been MP3-compressed. This header information can be configuredby selecting only information required for reproduction from the datacontained in the usage policy (see FIG. 5). This is done as shown in theabove-described content data configuration, for example, in FIG. 4. Thisinformation is added to the content transferred to the AV processsection 109. Specifically, identification values for usage policy data,required for the cryptography process section 302 and for data requiredfor the AV process section 109 during the reproduction process, areadded to each constituent data of the “usage policy” shown in FIG. 5.Only data indicating that these identification values are required forthe AV process section 109 are extracted as header information.

On receiving each content block shown in FIG. 63, the content analysissection 3091 of the AV process section 109 stores, in accordance withthe header information, a program content in the program storage section3093, if the content is a program. Otherwise, it stores the programcontent in the data storage section 3092 if the content is data.Thereafter, the compression and decompression section 3094 takes thedata out from the data storage section and decompresses it in accordancewith the MP3 program stored in the program storage section 3093. This isdone before outputting the decompressed data. If the program storagesection 3093 has the same program already stored therein, the programstorage process may be omitted.

FIG. 64 shows an example of a process for reproducing data of thecontent configuration in FIG. 63. At step S675, a data name is taken outfrom the information received separately from the content or from theheader in the content, and is then displayed on the monitor 3002. Thedata name, stored in the memory 3090 of the AV process section 109, is,for example, information such as the title of music (if the content issound data). At step S676, the user's selection is received from one ofthe various input means, such as the switches and the keyboard, via theinput interface 110.

Then at step S677, a data reproducing program (for example, the MP3,)corresponding to the user selection, is retrieved. The maximum range ofthis program retrieval is preferably set as the possible access range ofthe recording and reproducing device 300. For example, the media 500,communication means 600, and recording device 400 shown in FIG. 60 areincluded in the retrieval range.

The only content passed to the AV process section 109 is the datasection. The program content may be stored in another recording medium500 in the recording and reproducing device 300. Alternatively, theprogram content may be provided by the content provider via the medium500, such as a DVD or a CD. Accordingly, the retrieval range is set asthe possible access range of the recording and reproducing device 300.When a reproduction program is found as a result of the retrieval, areproduction process command, based on the user input data, is output tothe AV process section 109 (under the control of the CPU 106). At stepS679, the AV process section 109 extracts and decompress data dependingon the user's selection. In another embodiment, the program retrieval isexecuted before step S675, so that only the data in which the programhas been detected are displayed at step S675.

Next, FIG. 65 shows an example of a configuration wherein contentcontains compressed sound data 6303 and decompressed process program6302, and further contains a content reproduction priority as headerinformation 6301 therefor. This is an example of the above contentconfiguration in FIG. 61 with the reproduction priority added thereto asheader information. As in the above described section “(14) ProgramActivating Process Based on Activation Priority in Usage Policy inContent Data,” the order of reproduction is determined based on areproduction priority set among content received by the AV processsection 109.

FIG. 66 shows an example of a process for reproducing data of thecontent configuration in FIG. 65. At step S681, data stored in thememory 3090 of the AV process section 109 (that is, data information fordata to be reproduced) is set in a retrieval list. The retrieval list isset using some areas of the memory in the AV process section 109. Thenat step S682, the content analysis section 3091 of the AV processsection 109 selects data of top priority. At step S683, it reproducesthe selected data.

Next, FIG. 67 shows an example of a configuration wherein contentcomprises a combination of header information and program data 6402, orheader information 6403 and compressed data 6404. A reproductionpriority is added only to the header 6403 of the data content.

FIG. 68 shows an example of a process for reproducing data of thecontent configuration in FIG. 67. At step S691, data stored in thememory 3090 of the AV process section 109 (that is, data information fordata to be reproduced) is set in a retrieval list. The retrieval list isset using some areas of the memory in the AV process section 109. Thenat step S692, the content analysis section 3091 of the AV processsection 109 selects data of top priority.

Then at step S693, a data reproducing program (for example, the MP3),corresponding to the user selection, is retrieved. As in the process inthe flow in FIG. 64, the maximum range of this program retrieval ispreferably set as the possible access range of the recording andreproducing device 300. For example, the media 500, communication means600, and recording device 400 (shown in FIG. 60) are included in theretrieval range.

When a reproduction program is found as a result of the retrieval (Yesat step S694), the selected data is decompressed and reproduced usingthe program obtained as a result of the retrieval.

On the other hand, if no program is found as a result of the retrieval(No at step S694), the process proceeds to step S696. Step 696 deletesthe remaining data contained in the retrieval list (set at step S691)that must be reproduced using the same program. This is because it isapparent that a new attempt to retrieve a reproduction program from thisdata fails. Furthermore, when it is determined whether or not theretrieval list is empty (and if the list is determined not to be empty),the process returns to step S692 to extract data of the next highestpriority to execute the program retrieving process.

Thus, according to this configuration, if the compressed content isconstructed with its decryption (decompression) program the processsection (for example, the AV process section) receiving the content usesthe decompression process program attached to the compressed data inorder to execute the decompression and reproduction process.Alternatively, the process section retrieves the decompression andreproduction program based on the header information in the compresseddata to execute the decompression and reproduction process in accordancewith the program obtained as a result of the retrieval. The compresseddata can also comprise only data obtained by compressing the content oronly the decompression process program, since it has the headerinformation indicating what compressed data the content is or whatprocess the content executes. This eliminates the needs for processesexecuted by the user, such as the selection and retrieval of the datadecompressing program, thereby enabling efficient data reproduction.Moreover, the configuration with the reproduction priority in the headerenables the reproduction order to be automatically set to allow the userto omit the operation of setting the reproduction order.

In the above described embodiments, the MP3 is taken as an example of adecompression process program for compressed sound data content andsound compressed data. This configuration is also applicable to contentcontaining compressed data, or a decompression process program forcompressed image data, and provides similar effects in other case.

(16) Generation of Save Data and Storage and Reproduction of the Same inand from Recording Device

If, for example, the content executed in the recording and reproducingdevice 300 is a game program or the like and if the game program is tobe resumed a predetermined period of time after suspension, the state ofthe game is saved at the time of the suspension. That is, the state ofthe game is stored in the recording device 400 so as to be read out onresumption, enabling the game to be continued.

In conventional recording and reproducing devices 400 for gameapparatuses, personal computers, or the like, a save data preservationconfiguration is provided with such a configuration. This preserves savedata in a recording medium 500, such as a memory card, a floppy disk, agame cartridge, or a hard disk, which can be built into the recordingand reproducing device 300 or externally attached thereto. Inparticular, however, these recording and reproducing devices 300 have noconfiguration for maintaining the security of the save data and carryout the save process using, for example, specifications common to a gameapplication program.

Thus, for example, save data saved using a recording and reproducingdevice A may be used or rewritten by another game program However,little attention has been paid to the security of the save data.

The data processing apparatus according to the present inventionprovides a configuration that can maintain the security of save data.For example, save data for a certain game program is encrypted based oninformation used only by this game program before being stored in therecording device 400. Alternatively, the save data is encrypted based oninformation unique to the recording and reproducing device 300 beforebeing stored in the recording device 400. These methods enables theusage of the save data to be limited to particular apparatuses orprograms to maintain the security of the data. “Generation of Save Dataand Storage and Reproduction of the Same in and from Recording Device”in the present data processing apparatus will be explained below.

FIG. 69 is a block diagram illustrating a save data storage process inthe present data processing apparatus. Content from the medium 500, suchas a DVD or CD, or from the communication means 600, is provided to therecording and reproducing device 300. The provided content has beenencrypted with the content key Kcon. Kcon is a key unique to the contentas described above. The recording and reproducing device 300 obtains thecontent key in accordance with the process described in the abovedescribed section “(7) Process for Downloading from Recording andReproducing Device to Recording device” (see FIG. 22), to decrypt theencrypted content, and then stores it in the recording device 400. Thefollowing description is directed to a process executed by the recordingand reproducing device 300 to decrypt a content program from the medium500 or the communication means 600. It reproduces and executes thisprogram, and then stores the obtained save data in one of the variousrecording devices 400A, 400B, and 400B (such as external or built-inmemory card and hard disk) for reproduction. Or it downloads content inthe recording device 400A, reproduces and executes the content from therecording device 400A, and stores the resulting save data in aprocessing and recording device 400, for storing the save data in anyone of the various recording devices 400A, 400B, and 400B (such asexternal or built-in memory card and hard disk for reproduction andreproducing the save data).

The recording and reproducing device 300 has the recording andreproducing device identifier IDdev, the system signature key Ksys(which is a signature key shared throughout the system), the recordingand reproducing device signature key Kdev (which is unique to individualrecording and reproducing devices), and the master keys for generatingvarious individual keys, as previously described. The master keys areused to generate, for example, the distribution key Kdis or theauthentication key Kake, as described in detail in “(12) Configurationfor Generating Cryptography Process Keys Based on Master Keys.” Here,the type of the master key is not particularly limited, but a keyrepresenting the master keys of the recording and reproducing device 300is denoted by MKx. FIG. 69 shows an example of the cryptography key,Ksav, for save data in the lower part of the figure. The save datacryptography key, Ksav, is used for the encryption process executed tostore save data in one of the various recording device 400A to C, andfor the decryption process executed to reproduce these data therefrom.The processes for storing and reproducing save data will be explainedwith reference to FIG. 70 and subsequent figures.

FIG. 70 is a flow chart of a process of storing save data in one of therecording device 400A to C using either the content unique key or thesystem common key. The process in each flow is executed by the recordingand reproducing device 300. The recording device 400 storing the savedata in each flow may be any of the external recording devices 400A toC, but is not limited to a particular one.

At step S701, the recording and reproducing device 300 reads out thecontent ID, for example, the game ID. This ID is the data contained inthe identification information in the content data shown in thepreviously described FIGS. 4, 26, 27, and 32 to 35. On receiving acommand for storage of save data via the interface 110 (shown in FIG.2), the main CPU 106 commands the control section 301 to read thecontent ID.

The control section 301 takes the identification information out fromthe header in the content data via the read section if the executionprogram is content from a DVD, a CD-ROM, or the like (which is executedvia the read section 304), or takes it out via the recording devicecontroller 303 (if the execution program is a content stored in therecording device 400). If the recording and reproducing device 300 isexecuting the content program and the content ID has already been storedin RAM or another accessible recording medium in the recording andreproducing device 300, the identification information contained in theloaded data may be used without executing a new read process.

Then at step S702, the process is changed depending on whether or notthe program is to be localized. The program localization is used to setwhether or not a limitation is added that allows save data to be usedonly by this program. To allow the save data to be used only by thisprogram, “Program Localization” is set to “Yes.” To prevent the usage ofthe data from being limited to this program, “Program Localization” isset to “No.” This may be arbitrarily set by the user or may be set andstored in the content program by the content producer. The setlocalization is stored in one of the recording devices 400A to C (ofFIG. 69) as a data managing file.

FIG. 71 shows an example of the data managing file. The data managingfile is generated as a table. The table contains entries including datanumbers, content IDs, recording and reproducing device IDs, and programlocalization. The content ID is identification data for a contentprogram for which save data is saved. The recording and reproducingdevice ID indicates a recording and reproducing device 300 that hasstored the save data. An example thereof is [IDdev], shown in FIG. 69.The program localization is set to “Yes” in order to allow the save datato be used only by this program, or to “No” in order to prevent theusage of the data from being limited to this program. The programlocalization may be arbitrarily set by the user using the contentprogram, or may be set and stored in the content program by the contentproducer.

Referring back to FIG. 70, if the program localization is set to “Yes”at step S702, the process proceeds to step S703. At step 703, the keyunique to the content, for example, the content key Kcon, is read outfrom the content data and used as the save data cryptography key Ksav.Otherwise, the save data cryptography key, Ksav, is generated based onthe content unique key.

On the other hand, if the program localization is set to “No” at stepS702, the process proceeds to step S707. At step 707, the system commonkey stored in the recording and reproducing device 300 (for example, thesystem signature key), Ksys is read out from the internal memory 307 ofthe recording and reproducing device 300 and is used as the save datacryptography key Ksav. Otherwise, the save data cryptography key, Ksav,is generated based on the system signature key Ksys. Alternatively, acryptography key different from the other keys (which have beenseparately saved to the internal memory 307 of the recording andreproducing device 300) may be used as the save data cryptography keyKsav.

Then at step S704, the save data cryptography Ksav selected or generatedat step S703 or S707, is used to execute a process for encrypting savedata. This encryption process is executed by the cryptography processsection 302 (see FIG. 2) by applying, for example, the above describedDES algorithm.

The save data encrypted at step S704 is stored in the recording deviceat step S705. If there are a plurality of recording devices 400 that canstore save data (as shown in FIG. 69), the user selects one of therecording devices 400A to C in advance as a save data storagedestination. Further, at step S706, the program localization set at stepS702 (that is, “Yes” or “No” for the program localization) is written tothe data managing file described with reference to FIG. 71.

The process for storing the save data is thus completed. At step S702,save data for which “Yes” is selected for the program localization atstep S702, and which are encrypted at step S703 with the save dataencryption key Ksav (generated based on the content unique key) isprevented from being decrypted by content programs having no contentunique key information. Thus, these save data can be used only bycontent programs having the same content key information. In this case,however, the save data encryption key Ksav is not generated based oninformation unique to the recording and reproducing device 300, so thatsave data stored in a removable recording device 400 (such as a memorycard) can be reproduced even from a different recording and reproducingdevice 300, as long as they are used together with a correspondingcontent program.

Additionally, save data for which “No” is selected for the programlocalization at step S702 (and which are encrypted at step S707 with thesave data encryption key Ksav) can be reproduced and used, even if aprogram with a different content identifier is used, or if a differentrecording and reproducing device 300 is used.

FIG. 72 illustrates a process for reproducing save data stored by meansof the save data storage process in FIG. 20.

At step S711, the recording and reproducing device 300 reads out thecontent ID, for example, the game ID. This is a process similar to stepS701 previously described in FIG. 70, and which reads out data containedin the identification information of the content data.

Then at step S712, the data managing file (described with reference toFIG. 71) is read out from one of the recording devices 400A to C (shownin FIG. 69). The content ID (read out at step S711) and correspondinglyset program localization are extracted therefrom. In step S713, if thedata managing file has the program localization set to “Yes,” theprocess proceeds to step S714. If the data managing file has the programlocalization set to “No,” the process advances to step S717.

At step S714, the key unique to the content (for example, the contentkey Kcon) is read out from the content data and is used as the save datadecryption key Ksav. Or, the save data decryption key Ksav is generatedbased on the content unique key. This decryption key generating processuses a process algorithm corresponding to the encryption key generatingprocess. That is, a decryption key generating algorithm that enablesdata encrypted based on a certain content unique key to be decryptedwith a decryption key generated based on the same content unique key.

On the other hand, if it is determined at step S713 that the datamanaging file has the program localization set to “No,” then at stepS717, the system common key (stored in the recording and reproducingdevice 300), is read out from the internal memory 307 of the recordingand reproducing device 300 and is used as the save data decryption keyKsav. Or, the save data decryption key Ksav is generated based on thesystem signature key Ksys. Alternatively, a cryptography key differentfrom the other keys that have been separately saved to the internalmemory 307 of the recording and reproducing device 300 may be used asthe save data cryptography key Ksav.

Then at step S715, the save data decryption key Ksav, selected orgenerated at step S714 or S717, is used to execute a process fordecrypting save data, At step S716, the decrypted save data isreproduced and executed in the recording and reproducing device 300.

The save data reproduction process is thus completed. As describedabove, the save data decryption key is generated based on the contentunique key if the data managing file has the program localization set to“Yes,” otherwise, the save data decryption key is generated based on thesystem common key if the data managing file has the program localizationset to “No.” If the program localization is set to “Yes,” a decryptionkey cannot decrypt the save data without the same content ID for thecontent, thereby enabling the security of the save data to be improved.

FIGS. 73 and 74 show save data storage and reproduction flows,respectively, that generate save data encryption and decryption keysusing the content ID.

In FIG. 73, steps S721 to S722 are similar to steps S701 and S702 inFIG. 70, so description thereof is omitted.

If the program localization is set to “Yes” at step S722, then at stepS723, the content ID is read out from the content data and is used asthe save data decryption key Ksav, or the save data decryption key Ksavis generated based on the content ID. For example, the cryptographyprocess section 307 of the recording and reproducing device 300 canapply the master key MKx (stored in the internal memory of the recordingand reproducing device 300), to the content ID read out from the contentdata. This is done to obtain the save data decryption key Ksav that isbased, for example, on the DES (MKx, content ID). Alternatively, acryptography key different from the other keys (which have beenseparately saved to the internal memory 307 of the recording andreproducing device 300) may be used as the save data decryption keyKsav.

On the other hand, if the program localization is set to “No” at stepS722, then at step S727, the system common key stored in the recordingand reproducing device 300 (for example, the system signature key Ksys)is read out from the content data and is used as the save dataencryption key Ksav, or the save data encryption key Ksav is generatedbased on the system signature key. Alternatively, a cryptography keydifferent from the other keys (which have been separately saved to theinternal memory 307 of the recording and reproducing device 300) may beused as the save data decryption key Ksav.

The processing at step S724 and the subsequent steps is similar to thatat step S704 and the subsequent steps in the process flow in FIG. 70,and description thereof is thus omitted.

FIG. 74 shows a process flow for reproducing and executing save datastored in the recording device 400 during the save data storage processflow in FIG. 73. Steps S731 to S733 are similar to the correspondingprocessing in the above-described FIG. 72, except for step S734. At step734, the content ID is read out from the content data and is used as thesave data decryption key Ksav, or the save data decryption key, Ksav isgenerated based on the content ID. This decryption key generatingprocess uses a process algorithm corresponding to the encryption keygenerating process. That is, a decryption key generating algorithm thatenables data encrypted based on a certain content ID to be decryptedwith a decryption key generated based on the same content ID.

The subsequent processing, steps S735, S736, and S737 are similar to thecorresponding processing in FIG. 72, and description thereof is thusomitted. According to the save data storage and reproduction processesin FIGS. 73 and 74, if the program localization is set to “Yes,” thecontent ID is used to generate the save data encryption and decryptionkeys, so that as in the above save data storage and reproductionprocesses using the content unique key, save data cannot be obtainedwithout matching the corresponding content program, thereby enablingsave data to be saved more securely.

FIGS. 75 and 77 show save data storage (FIG. 75) and reproduction (FIG.77) flows, respectively, that generate save data encryption anddecryption keys using the recording and reproducing device unique key.

In FIG. 75, step S741 is similar to step S701 in FIG. 70, so descriptionthereof is omitted. At step S742, localization is or is not set for therecording and reproducing device 300. In the case of localizing aparticular recording and reproducing device 300 capable of utilizing thesave data, a recording and reproducing device localization, is set to“Yes.” That is, the save data is allowed to be used only by therecording and reproducing device that has generated and stored the data.To allow other recording and reproducing device to use the save data,the recording and reproducing device localization is set to “No.” If therecording and reproducing device localization is set to “Yes” at stepS742, the process proceeds to step S743, and if this localization is setto “No,” the process proceeds to step S747.

An example of the data managing file is shown in FIG. 76. The datamanaging file is generated as a table. The table contains entriesincluding data numbers, content IDs, recording and reproducing deviceIDs, and recording and reproducing device localization. The content IDis identification data for a content program for which save data issaved. The recording and reproducing device ID indicates a recording andreproducing device 300 that has stored the save data. An example thereofis [IDdev], shown in FIG. 69. The recording and reproducing devicelocalization is set to “Yes” in order to limit the usage of the savedata to a particular recording and reproducing device 300. That is, thesave data is allowed to be used only by the recording and reproducingdevice that has generated and stored the data. Recording and reproducingdevice localization is set to “No” in order to allow other recording andreproducing devices 300 to use the save data. The recording andreproducing device localization may be arbitrarily set by the user usingthe content program, or may be set and stored in the content program bythe content producer.

In the save data storage process flow in FIG. 75, if the recording andreproducing device localization is set to “Yes” at step S742, therecording and reproducing device unique key (for example, the recordingand reproducing device signature key, Kdev) is read out from theinternal memory 307 of the recording and reproducing device 300 data,and is used as the save data encryption key, Ksav, or the save dataencryption key Ksav is generated based on the recording and reproducingdevice signature key Kdev. Alternatively, a cryptography key, differentfrom the other keys which has been separately saved to the internalmemory 307 of the recording and reproducing device 300, may be used asthe save data decryption key Ksav.

On the other hand, if the recording and reproducing device localizationis set to “No” at step S742, then at step S747 the system common key(stored in the recording and reproducing device 300—for example, thesystem signature key Ksys) is read out from internal memory 307 of therecording and reproducing device 300 and used as the save dataencryption key Ksav, or the save data encryption key Ksav is generatedbased on the system signature key. Alternatively, a cryptography key,different from the other keys which has been separately saved to theinternal memory 307 of the recording and reproducing device 300, may beused as the save data decryption key Ksav.

The processing at steps S744 and S745 is similar to the correspondingprocessing in the process flow in FIG. 72, and description thereof isthus omitted.

At step S746, the content ID, the recording and reproducing device ID,and the recording and reproducing device localization “Yes/No” (set bythe user at step S742) are written to the data managing file (see FIG.76).

Furthermore, FIG. 77 shows a process flow for reproducing and executingsave data stored in the recording device 400 during the save datastorage process flow in FIG. 75. At step S751, the content ID is readout as in the corresponding processing in the above described inrelation to FIG. 72. Then at step S752, the recording and reproducingdevice ID (IDdev). stored in the memory of the recording and reproducingdevice 300. is read out.

At step S753, the content ID, the recording and reproducing device ID,and the set recording and reproducing device localization “Yes/No” areread out from the data managing file (see FIG. 76). If any entry in thedata managing file (which has the same content ID) has the recording andreproducing device localization set to “Yes,” the process is ended ifthe table entry has a recording and reproducing device ID different fromthat read out at step S752.

Next, if it is determined at step S754 that the data managing file hasthe recording and reproducing device localization set to “Yes,” theprocess proceeds to step S755. If the data managing file has therecording and reproducing device localization set to “No,” the processproceeds to step S758.

At step S755, the recording and reproducing device unique key (forexample, the recording and reproducing device signature key Kdev) isread out from the internal memory 307 of the recording and reproducingdevice 300 data and is used as the save data decryption key Ksav. Or,the save data encryption key Ksav is generated based on the recordingand reproducing device signature key Kdev. This decryption keygenerating process uses a process algorithm corresponding to theencryption key generating process. That is, a decryption key generatingalgorithm is used that enables data encrypted based on a certainrecording and reproducing device unique key to be decrypted with adecryption key (that was generated based on the same recording andreproducing device unique key) Alternatively, a cryptography key,different from the other keys, which has been separately saved to theinternal memory 307 of the recording and reproducing device 300, may beused as the save data decryption key Ksav.

On the other hand, at step S758, the system common key stored in therecording and reproducing device 300 (for example, the system signaturekey Ksys) is read out from internal memory 307 of the recording andreproducing device 300 and used as the save data decryption key Ksav.Or, the save data decryption key Ksav is generated based on the systemsignature key. Alternatively, a cryptography key different from theother keys (which has been separately saved to the internal memory 307of the recording and reproducing device 300) may be used as the savedata decryption key Ksav. The processing at the subsequent steps S756and 757 are similar to that at the corresponding steps in the abovedescribed save data reproduction process flow.

According to the save data storage and reproduction process flows shownin FIGS. 75 and 77, save data for which the recording and reproducingdevice localization is set to “Yes” is encrypted and decrypted using therecording and reproducing device unique key. This save data can thus bedecrypted and used only by the recording and reproducing device 300having the same recording and reproducing device unique key, i.e., thesame recording and reproducing device 300.

Next, FIGS. 78 and 79 show process flows for generating encryption anddecryption keys, for save data using the recording and reproducingdevice ID and storing and reproducing the save data.

In FIG. 78, the recording and reproducing device ID is used to encryptand store save data in the recording device 400. Steps S761 to S763 aresimilar to those in the above FIG. 75. At step S764, the recording andreproducing device ID (IDdev), read out from the recording andreproducing device, is used to generate the save data encryption keyKsav. The save data encryption key Ksav is obtained based on the Iddev.This is done, for example, applying the IDdev as the save dataencryption key Ksav, or applying the master key MKx (stored in theinternal memory of the recording and reproducing device 300) to obtainthe save data encryption key Ksav based on the DES (MKx, IDdev).Alternatively, a cryptography key different from the other keys whichhave been separately saved to the internal memory 307 of the recordingand reproducing device 300, may be used as the save data decryption keyKsav.

The subsequent process steps S765 to S768 are similar to thecorresponding processing in the above described FIG. 75, so descriptionthereof is omitted.

FIG. 79 shows a process flow for reproducing and executing the save datastored in the recording device 400 by means of the process in FIG. 78.Steps S771 to S774 are similar to the corresponding processing in FIG.77.

At step S775, the recording and reproducing device ID (Iddev), read outfrom the recording and reproducing device, is used to generate the savedata decryption key Ksav. The save data encryption key Ksav is obtainedbased on the Iddev. This is performed by, for example, applying theIDdev as this key Ksav, or applying the master key MKx (stored in theinternal memory of the recording and reproducing device 300) to obtainthis key Ksav based on the DES (MKx, IDdev). This decryption keygenerating process uses a process algorithm corresponding to theencryption key generating process. That is, a decryption key generatingalgorithm that enables data encrypted based on a certain recording andreproducing device unique key to be decrypted with a decryption keygenerated based on the same recording and reproducing device unique key.Alternatively, a cryptography key, different from the other keys whichhas been separately saved to the internal memory 307 of the recordingand reproducing device 300, may be used as the save data decryption keyKsav.

The subsequent process steps S776 to S778 are similar to thecorresponding processing in the above described FIG. 76.

According to the save data storage and reproduction process flows shownin FIGS. 78 and 79, save data for which the recording and reproducingdevice localization is set to “Yes” is encrypted and decrypted using therecording and reproducing device unique key. This save data can thus bedecrypted and used only by the recording and reproducing device 300having the same recording and reproducing device unique key, that is,the same recording and reproducing device 300.

Next, save data storage and reproduction processes of executing both theabove described program localization and recording and reproducingdevice localization will be explained with reference to FIGS. 80 to 82.

FIG. 80 shows a save data storage process flow. At step S781, thecontent ID is read out from the content data, at step S782, it isdetermined whether the program localization is set, and at step S783, itis determined whether the recording and reproducing device localizationis set.

If both the program localization and the recording and reproducingdevice localization are set to “Yes”, then at step S785 the save dataencryption key Ksav is generated based on both the content unique key(ex. Kcon) and the recording and reproducing device unique key (Kdev).The save data encryption key is obtained, for example, based onKsav=(Kcon XOR Kdev) or by applying the master key MKx (stored in theinternal memory of the recording and reproducing device 300) to obtainthis key based on Ksav=DES (MKx, Kcon XOR Kdev). Alternatively, acryptography key, different from the other keys which have beenseparately saved to the internal memory 307 of the recording andreproducing device 300, may be used as the save data decryption keyKsav.

If the program localization is set to “Yes” while the recording andreproducing device localization is set to “No,” then at step S786, thecontent unique key (ex. Kcon) is used as the save data encryption keyKsav. Or, the save data encryption key Ksav is generated based on thecontent unique key (ex. Kcon).

If the program localization is set to “No” while the recording andreproducing device localization is set to “Yes,” then at step S787, therecording and reproducing device unique key (Kdev) is used as the savedata encryption key Ksav. Or, the save data encryption key Ksav isgenerated based on the recording and reproducing device unique key(Kdev). Alternatively, a cryptography key, different from the other keys(which have been separately saved to the internal memory 307 of therecording and reproducing device 300), may be used as the save datadecryption key Ksav.

Further, if both the program localization and the recording andreproducing device localization are set to “No,” then at step S787, thesystem common key (for example, the system signature key Ksys) is usedas the save data encryption key Ksav. Or, the save data encryption keyKsav is generated based on the system signature key Ksys. Alternatively,a cryptography key, different from the other keys (which has beenseparately saved to the internal memory 307 of the recording andreproducing device 300), may be used as the save data decryption keyKsav.

At step S789, the save data encryption key Ksav generated at one of thesteps S785 to S788, is used to encrypt the save data, which is thenstored in the recording device 400.

Furthermore, at step S790, the localization (set at steps S782 and S783)is stored in the data managing file. The data managing file isconfigured, for example, as shown in FIG. 81, and contains entriesincluding data numbers, content IDs, recording and reproducing deviceIDs, program localization, and recording and reproducing devicelocalization.

FIG. 82 shows a process flow for reproducing and executing the save datastored in the recording device 400 by means of the process in FIG. 80.At step S791, the content ID and the recording and reproducing device IDare read out from the execution program. At step S792, the content ID,the recording and reproducing device ID, the program localization, andthe recording and reproducing device localization are read out from thedata managing file shown in FIG. 81. In this case, if the programlocalization is set to “Yes” and the content IDs are not the same, or ifthe recording and reproducing device localization is set to “Yes” andthe recording and reproducing device IDs are not the same, the processis ended.

Then at steps S793, S794, and S795, the decryption key generatingprocess is set to one of the four manners at steps 796 to S799 inaccordance with the data recorded in the data managing file.

If both the program localization and the recording and reproducingdevice localization are set to “Yes,” then at step S796, the save dataencryption key Ksav is generated based on both the content unique key(ex. Kcon) and the recording and reproducing device unique key (Kdev).Alternatively, a cryptography key different from the other keys (whichhave been separately saved to the internal memory 307 of the recordingand reproducing device 300) may be used as the save data decryption keyKsav. If the program localization is set to “Yes” while the recordingand reproducing device localization is set to “No,” then at step S797,the content unique key (ex. Kcon) is used as the save data encryptionkey Ksav. Or, the save data encryption key Ksav is generated based onthe content unique key (ex. Kcon). Alternatively, a cryptography keydifferent from the other keys (which have been separately saved to theinternal memory 307 of the recording and reproducing device 300) may beused as the save data decryption key Ksav.

If the program localization is set to “No” while the recording andreproducing device localization is set to “Yes,” then at step S798, therecording and reproducing device unique key (Kdev) is used as the savedata encryption key Ksav. Or, the save data encryption key Ksav isgenerated based on the recording and reproducing device unique key(Kdev). Alternatively, a cryptography key different from the other keys(which have been separately saved to the internal memory 307 of therecording and reproducing device 300) may be used as the save datadecryption key Ksav. Further, if both the program localization and therecording and reproducing device localization are set to “No,” then atstep S799, the system common key (for example, the system signature keyKsys) is used as the save data encryption key Ksav. Or, the save dataencryption key Ksav is generated based on the system signature key Ksys.Alternatively, a cryptography key different from the other keys (whichhave been separately saved to the internal memory 307 of the recordingand reproducing device 300) may be used as the save data decryption keyKsav.

These decryption key generating processes uses a process algorithmcorresponding to the encryption key generating process. That is, adecryption key generating algorithm that enables data encrypted based onthe same content unique key and recording and reproducing device uniquekey to be decrypted with a decryption key generated based on the samecontent unique key and recording and reproducing device unique key.

At step S800, the save data encryption key Ksav, generated at one of thesteps S796 to S799, is used to execute the decryption process. Thedecrypted save data are reproduced and executed in the recording andreproducing device 300.

According to the save data storage and reproduction process flows shownin FIGS. 80 and 82, save data for which “Yes” is selected for theprogram localization is encrypted and decrypted with the content uniquekey. This save data can be decrypted and used only if content datahaving the same content unique key is used. Additionally, save data forwhich “Yes” is selected for the recording and reproducing devicelocalization is encrypted and decrypted with the recording andreproducing device ID. This save data can be decrypted and used only bythe recording and reproducing device having the same recording andreproducing device ID, that is, the same recording and reproducingdevice. Consequently, both the content and the recording and reproducingdevice can set the localization to further improve the security of thesave data.

Although FIGS. 80 and 82 show the configuration for generating the savedata encryption key and the decryption key using the content unique keyand the recording and reproducing device unique key, the content ID andthe recording and reproducing device ID may be used instead of thecontent unique key and the recording and reproducing device unique key,respectively, to generate the save data encryption key and thedecryption key based on these IDs.

Next, a configuration for generating encryption and decryption keys,based on a password input by the user, will be described with referenceto FIGS. 83 to 85.

FIG. 83 shows a process flow for generating a save data encryption keybased on a password input by the user and storing save data in therecording device.

At step S821, the content ID is read out from the content data as ineach of the above described processes. At step S822, the user determineswhether to set the program localization. The data managing file set inthis configuration has, for example, the configuration shown in FIG. 84.

As shown in FIG. 84, the data contains data numbers, content IDs,recording and reproducing device IDs, and user set program localization.The “user set program localization” is an entry that determines whetheror not the usage of the program is limited to a particular user.

If the localization is set to “Yes” at step S822 in the process flow inFIG. 83, then at step S823, the user's password is input. The passwordis input from an input means such as the keyboard shown in FIG. 2.

The input password is output to the cryptography process section 302(under the control of the main CPU 106 and the control section 301) andthe processing at step S824 is executed. That is, the save dataencryption key Ksav is generated based on the input user password. Thesave data encryption key Ksav may be generated by, for example, settingthe password itself as this key Ksav or using the master key MKx of therecording and reproducing device to generate this key Ksav based on thesave data encryption key Ksav=DES (MKx, password). Alternatively, aunidirectional function may be applied, using the password as an input,so that an encryption key can be generated based on an output from thefunction.

If the user localization is set to “No” at step S822, then at step S828,a save data encryption key is generated based on the system common keyof the recording and reproducing device 300.

Further, at step S825, the save data encryption key Ksav (generated atstep S824 or S828) is used to encrypt the save data, and at step S826,the encrypted save data is stored in the recording device 400.

At step S827, the program localization set by the user at step S822 iswritten to the data managing file in FIG. 84, so as to be associatedwith the content ID and the recording and reproducing device ID.

FIG. 85 illustrates a process for reproducing the save data stored bymeans of the process in FIG. 83. At step S831, the content ID is readout from the content data. At step S832, the content ID and the programlocalization set by the user are read out from the data managing fileshown in FIG. 84.

At step S833, determination is made based on the data in the datamanaging file. If “the user set program localization” is set to “Yes,”then at step S834 the user is prompted to input a password. Then at stepS835, a decryption key is generated based on the input password. Thisdecryption key generating process uses a process algorithm correspondingto the encryption key generating process. That is, a decryption keygenerating algorithm is used that enables data encrypted based on acertain password to be decrypted with a decryption key generated basedon the same password.

If it is determined at step S833 that the program localization by theuser is set to “No,” then at step S837 the system common key stored inthe internal memory of the recording and reproducing device 300 is usedto generate the save data decryption key Ksav by using the systemsignature key Ksys. Alternatively, an encryption key, different from theother keys which have been separately saved to the internal memory 307of the recording and reproducing device 300, may be used as the savedata encryption key Ksav.

At step S836, the decryption key Ksav (generated at step S835 or S837)is used to decrypt the save data stored in the recording device. At stepS838, the recording and reproducing device 300 reproduces and executesthe save data.

According to the save data storage and reproduction process flows shownin FIGS. 83 and 85, save data for which “Yes” is selected for “the userset program localization” is encrypted and decrypted with the key basedon the user input password. This is done so that this save data can bedecrypted and used only if the same password is input, thereby improvingthe security of the save data.

The several aspects of the save data storage and reproduction processeshave been described, but it is also possible to implement a processobtained by merging the above described processes together. For example,an aspect of generating save data encryption and decryption keys may beperformed using an arbitrary combination of the password, the recordingand reproducing device ID, the content ID, and other information.

(17) Configuration for Excluding (Revoking) Invalid Apparatuses

As described above, the data processing apparatus according to thepresent invention improves the security of provided content and allowsuch contents to be used only by valid users. It uses the configurationwherein the recording and reproducing device 300 executes processes suchas authentication and encryption on various content data provided by themedium 500 (see FIG. 3), or the communication means 600, and then storesthe data in the recording device 400.

As understood from the above description, the input content isauthenticated, encrypted, and decrypted using the various signaturekeys, master keys, and integrity-check-value-generating keys (see FIG.18) that are stored in the internal memory 307 (which is configured inthe cryptography process section 302 of the recording and reproducingdevice 300). The internal memory 307 storing the key information isdesirably characterized to restrain external illegal reads. It comprisesa semiconductor chip that essentially rejects external accesses and hasa multilayer structure, an internal memory sandwiched between dummylayers of aluminum or the like or arranged in the lowest layer, and anarrow range of operating voltages and/or frequencies. If, however, thekey data or the like should be read out from the internal memory 307 andcopied to an unauthorized recording and reproducing device 300, thecopied key information may be used for invalid usage of the content.

A configuration for preventing the invalid use of content, based oninvalid copying of a key, will be described below.

FIG. 86 is a block diagram illustrating “(17) Configuration forExcluding Invalid Apparatuses,” which corresponds to this configuration.The recording and reproducing device 300 is similar to the recording andreproducing device 300 shown in FIGS. 2 and 3. It has an internalmemory, and the previously described various key data (FIG. 18) andrecording and reproducing device ID. Here, the recording and reproducingdevice ID, the key data, or the like, copied by a third person, is notnecessarily stored in the internal memory 307. The key data or the likein the recording and reproducing device 300 shown in FIG. 86 arecollectively or distributively stored in a memory section accessible tothe cryptography process section 302 (see FIGS. 2 and 3).

To implement the configuration for excluding invalid apparatuses, a listof invalid recording and reproducing device IDs is stored in the headersection of the content data. As shown in FIG. 86, the content data holdsa revocation list as the list of invalid recording and reproducingdevice IDs (IDdev). Further, a list integrity check value ICVrev is usedto check the revocation list for tampering. The list of invalidrecording and reproducing device IDs (IDdev) contains the identifiersIDdev of invalid recording and reproducing devices 300, determined bythe content provider or manager, based on the state of distribution ofinvalid copies or the like. The revocation list may be encrypted withthe distribution key Kdis before being stored. The decryption processexecuted by the recording and reproducing device 300 is similar to, forexample, that in the content download process in FIG. 22.

Here, for better understanding, the revocation list is shown as singledata in the content data, but may be contained, for example, in thepreviously described usage policy (for example, see FIGS. 32 to 35),which is a component of the header section of the content data. In thiscase, the previously described integrity check value ICVa is used tocheck the usage policy data containing the revocation list fortampering. If the revocation list is contained in the usage policy, theintegrity check value A, ICVa, is used for the check, and theintegrity-check-value-A-generating key, Kicva, in the recording andreproducing device 300 is used, thereby eliminating the need to storethe integrity-check-value-generating key Kicv-rev.

If the revocation list is contained in the content data as independentdata, the revocation list is checked using the list integrity checkvalue ICVrev (for checking the revocation list for tampering), and anintermediate integrity check value is generated from the list integritycheck value ICVrev and another partial integrity check value in thecontent data, and is used to carry out a verification process.

A method for checking the revocation list using the list integrity checkvalue ICVrev for checking the revocation list for tampering is similarto the process for generating the integrity check value such as ICVa orICVb as explained in the above-described FIGS. 23 and 24. That is, thecalculation is executed in accordance with the ICV calculation methoddescribed in FIGS. 23 and 24 and other figures. The key used is theintegrity-check-value-generating key, Kicv-rev (stored in the internalmemory 307 of the recording and reproducing device cryptography processsection 302), and using the revocation list contained in the contentdata as a message. The calculated integrity check value ICV-rev′ and theintegrity check value ICV-rev (stored in the header), are comparedtogether. If they are equal, it is determined that the list has not beentampered with.

The intermediate integrity check value, containing the list integritycheck value ICVrev, is generated, for example, by using thetotal-integrity-check-value-generating key Kicvt as a key. Kicvt isstored in the infernal memory 307 of the recording and reproducingdevice cryptography process section 302. The ICV calculation methoddescribed in FIG. 7 and other figures is applied to a message stringcomprising the integrity check values A and B and list integrity checkvalue ICVrev in the verified header. The content integrity check valueis added thereto depending on the format, as shown in FIG. 25.

The revocation list and the list integrity check value are provided tothe recording and reproducing device 300 via the medium 500 (such as aDVD or a CD), or the communication means 600, or via the recordingdevice 400 (such as a memory card). In this case, the recording andreproducing device 300 may hold valid key data or illegally copied IDs.

FIGS. 87 and 88 illustrate a process for excluding invalid recording andreproducing devices 300 in this configuration. FIG. 87 shows a processfor excluding (revoking) invalid recording and reproducing devices 300if content is provided by the medium 500 (such as a DVD or a CD) or thecommunication means 600. FIG. 88 shows a process for excluding(revoking) invalid recording and reproducing devices 300 if content isprovided by the recording device 400 (such as a memory card).

First, the process flow in FIG. 87 will be explained. At step S901, themedium 500 is installed and a request is made for content, that is, areproduction or download process. The process shown in FIG. 87corresponds to a step executed, for example, before installation of themedium 500 (such as DVD or the like) in the recording device 400,followed by the download process. The download process is as previouslydescribed with reference to FIG. 22 and is executed as a step before theprocess flow in FIG. 22 or as a process inserted into this process flow.

If the recording and reproducing device 300 receives content via thecommunication means 600 (such as a network), then at step S911, acommunication session with a content distribution service side isestablished. The process then proceeds to step S902.

At step S902, the revocation list (see FIG. 86) is obtained from theheader section of the content data. In this list-obtaining process, ifthe content is present in the medium 500, the control section 301 (shownin FIG. 3) reads it out therefrom via the read section 304. If thecontent is obtained from the control section, the communication means600 shown in FIG. 3 receives it from the content distributing side viathe communication section 305.

Next, at step S903, the control section 301 passes the revocation list(obtained from the medium 500 or the communication means 600), to thecryptography process section 302. Cryptography process section 302 isthen caused to execute the check value generating process. The recordingand reproducing device 300 internally has therevocation-integrity-check-value-generating key Kicv-rev. It calculatesthe integrity check value ICV-rev′ in accordance with the ICVcalculation method described in FIGS. 23 and 24 and other figures. Thisis performed by applying the integrity-check-value-generating keyKicv-rev, using the received revocation list as a message. It comparesthe result of the calculation with the integrity check value, ICV-rev(stored in the header) If they are equal, it determines that the listhas not been tampered with (Yes at step S904). If the values are notequal, the recording and reproducing device determines that the list hasbeen tampered with. In that case, the process proceeds to step S909 toindicate a process error to end the process.

At step S905, the control section 306 of the recording and reproducingdevice cryptography process section 302 causes the encryption/decryptionsection 308 of the recording and reproducing device cryptography processsection 302 to calculate the total integrity check value ICVt′. Thetotal integrity check value ICVt′ is generated by using the systemsignature key Ksys as a key. Ksys is stored in the internal memory 307of the recording and reproducing device cryptography process section302. The intermediate integrity check value is encrypted based on theDES, as shown in FIG. 25. The verification process, with each partialintegrity check value such as the ICVa or ICVb, is omitted from theprocess flow shown in FIG. 87. Verification with these partial checkvalues is carried out depending on the data format as in the processflow in the previously described FIGS. 39 to 45.

Then at step S906, the generated total integrity check value ICVt′ iscompared with the integrity check value ICVt in the header. If they areequal (Yes at step S906), the process advances to step S907. If thevalues are not equal, the recording and reproducing device determinesthat the list has been tampered with, and the process proceeds to stepS909 to indicate a process error to end the process.

As previously described, the total integrity check value ICVt is used tocheck all the partial integrity check value contained in the contentdata, such as the ICVa and ICVb and integrity check values forcorresponding content blocks, which are dependent on the data format. Inthis case, however, the list integrity check value ICVrev, for checkingthe revocation list for tampering, is added to the partial integritycheck values. All of these integrity check values are checked fortampering. If the total integrity check value equals the integrity checkvalue ICVt, stored in the header, it is determined that none of the ICVaand ICVb, the content block integrity check values, and the listintegrity check value ICVrev have not been tampered with.

Further at step S907, the revocation list, which has been determined tobe free from tampering, is compared with the recording and reproducingdevice ID (IDdev) stored in this recording and reproducing device 300.

If the list of invalid recording and reproducing device Ids, IDdev (readout from the content data) contains the identifier IDdev of thisrecording and reproducing device 300, this recording and reproducingdevice 300 is determined to have illegally copied key data. The processthen advances to step S909 to abort the subsequent procedure. Forexample, the process disables, for example, the execution of the contentdownload process in FIG. 22.

At step S907, if the list of invalid recording and reproducing deviceIDs IDdev is determined not to contain the identifier IDdev of thisrecording and reproducing device 300, this recording and reproducingdevice 300 is determined to have valid key data. The process proceeds tostep S908 to enable the subsequent procedure, for example, the programexecuting process or the content download process in FIG. 22 or otherfigures.

FIG. 88 shows a process executed to reproduce content data stored in therecording device 400, such as a memory card. As previously described,the recording device 400 (such as a memory card) and the recording andreproducing device 300 carry out the mutual authentication processdescribed in FIG. 20 (step S921). Only if the mutual authentication issuccessful at step S922 does the process proceed to step S923 and thesubsequent processing. Whereas if the mutual authentication fails, anerror occurs at step S930 to prevent the subsequent processing frombeing executed.

At step S923, the revocation list (see FIG. 86) is obtained from theheader section of the content data. The processing at subsequent stepsS924 to 930 is similar to the corresponding processing in FIG. 87. Thatis, the list is verified with the list integrity check value (S924 andS925) and with the total integrity check value (S926 and S927). The listentry is compared with the recording and reproducing device ID IDdev(S928). Then, if the list of invalid recording and reproducing deviceIds, Iddev, contains the identifier IDdev of this recording andreproducing device 300, this recording and reproducing device 300 isdetermined to have illegally copied key data. Then the process advancesto step S930 to abort the subsequent procedure. For example, the processdisables, for example, the execution of the content reproduction processin FIG. 28. On the other hand, if the list of invalid recording andreproducing device Ids, Iddev, is determined not to contain theidentifier IDdev of this recording and reproducing device 300, thisrecording and reproducing device 300 is determined to have valid keydata, and the process proceeds to step S929 to enable the subsequentprocedure.

As described above, according to the present data processing apparatus,the data identifying invalid recording and reproducing devices 300, thatis, the revocation list containing the identifiers IDdev of invalidrecording and reproducing devices 300, is contained in the content(provided by the content provider or manager) as constituent data of theheader section of the content data. Before using the content in therecording and reproducing device 300, the recording and reproducingdevice user collates the recording and reproducing device ID, IDdev(stored in the memory of this recording and reproducing device 300),with the ID in the list and prevents subsequent processing if matchingdata are found. Consequently, the content can be prevented from beingused by invalid recording and reproducing devices 300 that store copiedkey data in their memory.

(18) Method for Configuring and Manufacturing Secure Chip

As previously described, the internal memory 307 of the recording andreproducing device cryptography process section 302 or the internalmemory 405 of the recording device 400 holds important information suchas the cryptography keys and thus needs to be structured to rejectexternal invalid reads. Thus, the recording and reproducing devicecryptography process section 302, and the recording device cryptographyprocess section 401, are configured as a tamper resistant memory. Thetamper resistant memory is characterized to restrain external illegalreads in that it comprises, for example, a semiconductor chip thatrejects external accesses and has a multilayer structure, an internalmemory sandwiched between dummy layers of aluminum or the like orarranged in the lowest layer, and a narrow range of operating voltagesand/or frequencies.

As understood from the above description, however, data such as therecording and reproducing device signature key (Kdev), which varydepending on the recording and reproducing device 300, must be writtento the internal memory 307 of the recording and reproducing devicecryptography process section 302. Additionally, data rewrites or readsmust be difficult after individual information for each chip (forexample, identification information (ID) and encryption key information)has been written to a non-volatile storage area in the chip, forexample, a flash memory or an FeRAM, for example, after shipment.

A conventional method for making data reads and rewrites difficultcomprises, for example, making a data write command protocol secret, orseparating signal lines on the chip for accepting the data write commandfrom communication signal lines used after completion of the product, sothat the data write command will not be effective unless the signal isdirectly transmitted to the chip.

Even with such a conventional method, however, those who have atechnical knowledge of storage elements can output signals to a datawrite area of the chip if they have a facility and a technique fordriving the circuit, and even if a data write command protocol issecret, there is always a possibility that the protocol may be analyzed.

Distribution of elements for storing cryptography process data, whichallow secret data to be modified, may threaten the entire cryptographyprocess system. In addition, to prevent data from being read out, it ispossible to avoid implementing the data read command. In this case,however, even if a regular data write has been executed, it may beimpossible to determine whether or not the written data has beenaccurately written. This can result in the possibility of supplyingchips with inappropriate data written thereto.

In view of these conventional techniques, the present invention providesa secure chip configuration that enables data to be accurately writtento a non-volatile memory, such as a flash memory or an FeRAM, whilerestraining data from being read out therefrom, as well as a method formanufacturing such a secure chip.

FIG. 89 shows a security chip configuration applicable to, for example,the above-described recording and reproducing device cryptographyprocess section 302, or the cryptography process section 401 of therecording device 400. FIG. 89(A) shows a security chip configurationformed during a chip manufacturing process, that is, during a data writeprocess. FIG. 89(B) shows an example of the configuration of a product,such as the recording and reproducing device 300 or the recording device400, which has a security chip mounted in the product and having datawritten thereto.

During the manufacturing process, a process section 8001 of the securitychip has mode specifying signal lines 8003 and various command signallines 8004 connected thereto. It writes or reads data to or from astorage section 8002. Storage section 8002 comprises a non-volatilememory. Data is written or read depending on, for example, whether thechip is in a data write mode or a data read mode.

In the security chip mounted product in FIG. 89(B), the security chip isconnected to an externally connected interface, peripheral equipment,and other elements via general purpose signal lines. The mode signallines 8003 are not connected. Specific processing for the mode signallines 8003 includes connecting these lines 8003 to ground, increasingthe voltage on these lines to Vcc, cutting them, sealing them with aninsulator resin, etc. Such processing hinders the mode signal lines 8003in the security chip from being accessed after shipment, therebypreventing data from being externally read out from the chip or writtenthereto.

Further, the security chip 8000 of this configuration hinders data frombeing written to the storage section 8002 while hindering written datafrom being read out therefrom, thereby preventing invalid data writes orreads even if a third person successfully accesses the mode signal lines8003. FIG. 90 shows a process flow of a data write to, or a data readfrom, the security chip of this configuration.

At step S951, the mode signal lines 8003 are set for a data write orread mode.

At step S952, authentication information is taken out from the chip. Thesecurity chip of this configuration stores information required for theauthentication process, such as a password and key information for theauthentication process for the cryptography technique, for example, bywires or the mask ROM configuration. At step S952, this authenticationinformation is read out to execute the authentication process. If, forexample, a regular data write jig and data read device are connected tothe general purpose signal lines to execute the authentication process,the authentication will be successful (Yes at step S953). If, however,an invalid data write jig and data read device are connected to thegeneral purpose signal lines to execute the authentication process, theauthentication will fail (No at step S953), and the process is stopped.The authentication process can be executed, for example, in accordancewith the mutual authentication process procedure previously described inFIG. 13. The process section 8001, shown in FIG. 89(A), has aconfiguration capable of such an authentication process. This can beimplemented, for example, using a configuration similar to a commandregister integrated into the control section 403 of the cryptographyprocess section 401 of the recording device 400 (shown in the previouslydescribed FIG. 29). For example, the process section of the chip in FIG.89(A) has a configuration similar to the command register, integratedinto the control section 403 of the cryptography process section 401 ofthe recording device 400 shown in FIG. 29. It carries out an appropriateprocess to enable the authentication process sequence to be executed inresponse to an input of a predetermined command from an apparatusconnected to the various command signal lines 8004.

The process section 8001 accepts the data write or read command toexecute the data write (step S955) or read (step S956) process only ifthe authentication process is successful.

As described above, the security chip of this configuration isconfigured to execute the authentication process on a data write orread, thereby preventing an unauthorized third person from reading orwriting data to or from the storage section of the security chip.

FIG. 91 shows an embodiment of a securer element configuration. In thisexample, the storage section 8200 of the security chip is separated intotwo areas. One of the areas is a Read Write (RW) area 8201, which datacan be written and read to and from. The other section is a Write Only(WO) area 8202 which data can only be written to.

In this configuration, cryptography key data, ID data, and other datawhich require high security are written to the Write Only area 8202,whereas integrity check data and other data which do not require so highsecurity are written to the Read Write area 8201.

As a process for reading data out from the Read Write (RW) area 8201,the process section 8001 executes a data read process involving theauthentication process described in the above described FIG. 90. Thedata write process, however, is executed following the flow in FIG. 92.

At step S961 in FIG. 92, the mode signal lines 8003 are set for thewrite mode. At step S962, an authentication process, similar to thatdescribed in the above FIG. 90, is executed. When the authenticationprocess is successful, the process proceeds to step S963 to output tothe process section 8001, a command for writing information such as keydata which requires high security to the Write Only (WO) area 8202 viathe command signal lines 8004, while writing check data or other data,which do not require as high a security, to the Read Write (RW) area8201.

On receiving the command, the process section 8001 executes a data writeprocess at step S964. This is done on the Write Only (WO) area 8202 orthe Read Write (RO) area 8201, depending on the command.

In addition, FIG. 93 shows a process for verifying data written to theWrite Only (WO) area 8202.

At step S971 in FIG. 93, the process section 8001 causes the Write Only(WO) area 8202 to execute the cryptography process based on the writtendata. Like the above authentication process executing configuration,this execution configuration is implemented by a configuration forsequentially executing the cryptography process sequence stored in thecommand register. Additionally, the cryptography process algorithmexecuted in the process section 8001 is not particularly limited. Forexample, the previously described DES algorithm can be carried out.

Then at step S972, a verification device (connected to the securitychip) receives the result of the cryptography process from the processsection 8001. Then at step S973, the result of the application of acryptography process (similar to the algorithm executed by the processsection 8001) on the regular write data written to the storage sectionat step S973 is compared with the result of encryption from the processsection 8001.

If the compared results are identical, it is verified that the datawritten to the Write Only (WO) area 8202 is correct.

With this configuration, if the authentication process should bedeciphered to enable the read command to be executed, data can be readout only from the Read Write (RW) area 8201, while data written to theWrite Only (WO) area 8202 cannot be read out. Thus this configurationprovides much higher security. In addition, unlike chips that prohibitdata reads, this chip includes the Read Write (RW) area 8201 to enablememory accesses to be validated.

This invention has been described with reference to the particularembodiments. Obviously, however, modifications or substitutions may bemade to the present invention by those skilled in the art withoutdeviating from the spirits thereof. That is, the present invention hasbeen disclosed for illustrative purposes only and should not beinterpreted in a restrictive manner. In addition, in the above describedembodiments, the recording and reproducing device, capable of recordingand reproducing content, is described by way of example. However, theconfiguration of the present invention is applicable to apparatusescapable of either recording or reproducing data. The present inventioncan be implemented in personal computers, game apparatuses, and othervarious data processing apparatuses in general.

Although the invention herein has been described with reference toparticular embodiments, it is to be understood that these embodimentsare merely illustrative of the principles and applications of thepresent invention. It is therefore to be understood that numerousmodifications may be made to the illustrative embodiments and that otherarrangements may be devised without departing from the spirit and scopeof the present invention as defined by the appended claims.

1. A data processing system comprising: a recording and reproducingapparatus having a processing section configured to receive a commandidentifier and encrypted data from an external apparatus; and arecording apparatus configured to be installed in and removed from therecording and reproducing apparatus, the recording apparatus having anencryption processing section for executing encryption processing on theencrypted data transmitted to and from said recording and reproducingapparatus, said encryption processing section including a controlsection operable to receive said command identifier in accordance with apre-defined setting sequence, to retrieve a command from a registerbased on said command identifier, and to have said command executed onthe encrypted data, said recording apparatus further including a commandregister for storing said command in accordance with said pre-definedsetting sequence, wherein when said command identifier differs from saidpre-defined setting sequence, said control section is operable to cancelexecution of said command, said pre-defined setting sequence being acommand number setting sequence in which numbers are sequentiallyincremented; and a sequence set such that an authentication commandidentifier corresponding to a authentication processing command sequenceis executed prior to a command sequence corresponding to an encryptionprocessing command sequence for executing said encryption processing,said encryption key processing command sequence including encryption keyexchange processing for encryption data stored in a storage unit in saidrecording apparatus, the authentication processing command sequenceexecuting authentication processing between said recording andreproducing apparatus and said recording apparatus; and wherein saidcontrol section is operable to manage an order of command executionbased on said pre-defined setting sequence and said command identifierin said encryption key exchange processing, and said control sectiondoes not accept command processing from an external apparatus, includingsaid recording and reproducing apparatus, during command executionrelating to said encryption key exchange processing when said commandprocessing is different from said pre-defined setting sequence.
 2. Thedata processing system according to claim 1, wherein: and said controlsection is operable to store a value of said command identifier receivedfrom said recording and reproducing apparatus in a memory and to comparea new command identifier received from said recording and reproducingapparatus with said pre-defined setting sequence based on said receivedvalue stored in said memory.
 3. The data processing system according toclaim 1, wherein: when authentication is established between said firstapparatus and said recording apparatus, said control section is operableto: set an authentication flag indicating that said authenticationprocessing is finished, execute command management control to enableexecution of said encryption processing command sequence during settingof said authentication flag, and reset said authentication flag whenrepeating said authentication processing command sequence.
 4. The dataprocessing system according to claim 1, wherein: said recordingapparatus has a data storage section for storing said encryption data;said recording and reproducing apparatus is configured to store data ina storage section of said recording apparatus, and the recording andreproducing apparatus is configured for retrieving said data stored insaid storage section to reproduce and execute said data; and saidrecording and reproducing apparatus further includes an encryptionprocessing section for executing said encryption processing oftransmitted data with said storage section.
 5. The data processingsystem according to claim 4, wherein: said recording apparatus includesa key block for storing an authentication key and a storing key, saidauthentication key being usable in authentication processing betweensaid recording and reproducing apparatus and said recording apparatus,and said storing key being usable as an encryption key for saidencryption data stored in said storage section; and said control sectionis operable to receive a command identifier from said recording andreproducing apparatus, to execute authentication processing using saidauthentication key in accordance with said pre-defined setting sequence,and, after completing said authentication processing, to execute saidencryption processing of data accompanying key exchange processing usingsaid storing key.
 6. The data processing system according to claim 5,wherein: said key block includes a plurality of key blocks each storingsaid authentication key and said storing key, said authentication keybeing different from said storing key; and said recording andreproducing apparatus is operable to notify said recording apparatus ofone key block as a designated key block out of said plurality of keyblocks, said designated key block being used in said authenticationprocessing and said encryption processing; and said recording apparatusis operable to execute said authentication processing using saidauthentication key stored in said designated key block and to executesaid encryption processing of said data using said storing key in saiddesignated key block.
 7. The data processing system according to claim1, wherein the processing section further configured to, when theencrypted data is of a particular format, storing the encrypted data inthe recording apparatus before the command is executed on the encrypteddata.
 8. The data processing system according to claim 1, wherein theexternal source includes a non-transitory recording medium.
 9. The dataprocessing system according to claim 1, wherein the external source is adevice located at a different network location from both the recordingand reproducing apparatus and the recording apparatus.
 10. A recordingdevice, comprising: a data storage section operable to store contentdata that is transferable to an external apparatus; and an encryptionprocessing section operable to execute encryption processing oftransmission data with said external apparatus, said encryptionprocessing section including a control section operable to receive acommand identifier transferred from said external apparatus inaccordance with a setting sequence, to retrieve a command from aregister based on said command identifier, and to have said commandexecuted, said control section further including a command numbersetting sequence in which numbers are sequentially incremented as saidsetting sequence; wherein, when said command identifier differs fromsaid setting sequence, said control section is operable to (1) cancelprocessing of said command and (2) not accept command processing fromany external apparatus during command execution relating to anencryption key exchange processing for encrypting data stored in astorage unit in said recording device, when said command processing isdifferent from said pre-defined setting sequence.
 11. The recordingdevice according to claim 10, further comprising: a command register forstoring said command in accordance with said setting sequence; anauthentication processing command sequence for executing authenticationprocessing between said external apparatus and said recording device; anencryption processing command sequence for executing said encryptionprocessing relating to transferred data between said external apparatusand said recording device; and a sequence set such that said commandidentifier corresponding to said authentication processing commandsequence is executed prior to a command sequence corresponding to saidencryption processing command sequence.
 12. The recording deviceaccording to claim 11, wherein said encryption processing commandsequence includes the encryption key exchange processing for encryptiondata stored in a storage unit in said recording device.
 13. Therecording device according to claim 11, wherein: said control section isfurther operable to set an authentication flag, to execute commandmanagement control, and to reset said authentication flag when repeatingsaid authentication processing command sequence; when authentication isestablished between said external apparatus and said recording device,said authentication flag is set to indicate that said authenticationprocessing is finished; and said command management control enablesexecution of said encryption processing command sequence during settingof said authentication flag.
 14. The recording device according to claim12, wherein: said control section is operable to manage an order ofcommand execution based on said setting sequence and said commandidentifier in said encryption key exchange processing; and said controlsection does not accept command processing from said external apparatusduring said command execution relating to said encryption key exchangeprocessing when said command processing is different from said settingsequence.
 15. The recording device according to claim 10, furthercomprising: a key block for storing an authentication key and a storingkey, said authentication key being usable in authentication processingbetween said external apparatus and said recording device, and saidstoring key being usable as an encryption key for said data stored insaid data storage section; wherein control section is operable toreceive said command identifier from said external apparatus, to executesaid authentication processing using said authentication key, and aftercompleting said authentication processing, to execute said encryptionprocessing of data accompanying key exchange processing using saidstoring key.
 16. The recording device according to claim 15, wherein:said key block includes a plurality of key blocks, each storing saidauthentication key and said storing key; said external apparatus isoperable to notify said recording device of one key block out of saidplurality of key blocks, said one key block being a designated key blockused in authentication processing and encryption processing of selecteddata; and said recording device is operable to execute saidauthentication processing using said authentication key stored in saiddesignated key block to execute said encryption processing using saidstoring key in said designated key block.
 17. A data processing methodin a data processing system having a first apparatus and a secondapparatus operable to transmit encryption data to each other, saidmethod comprising: executing command processing control in said secondapparatus for receiving a command identifier in accordance with asetting sequence, said command identifier being transferred from saidfirst apparatus; retrieving, from a register, a command based on saidcommand identifier; processing said command; and when said commandidentifier is different from said setting sequence, canceling saidprocessing of said command and not accepting command processing from anyexternal apparatus during command execution relating to an encryptionkey exchange processing for encrypting data stored in a storage unit insaid recording device; wherein said setting sequence is a command numbersetting sequence in which numbers are sequentially incremented.
 18. Thedata processing method according to claim 17, said command processingcontrol including: executing an authentication processing commandsequence for executing authentication processing between said firstapparatus and said second apparatus; and executing an encryptionprocessing command sequence for executing encryption processing relatingto transferred data between said first apparatus and said secondapparatus; wherein said setting sequence is a sequence for executingsaid authentication processing command sequence prior to said encryptionprocessing command sequence.
 19. The data processing method according toclaim 18, wherein said encryption processing command sequence includesencryption key exchange processing for encryption data stored in astorage unit in said second apparatus.
 20. The data processing methodaccording to claim 18, further including: when authentication isestablished between said first apparatus and said second apparatus,setting an authentication flag indicating that said authenticationprocessing is finished; and executing command management control duringsaid command processing control to enable execution of said encryptionprocessing command sequence when setting said authentication flag. 21.The data processing method according to claim 20, further includingresetting said authentication flag when executing a new authenticationprocessing command sequence.
 22. The data processing method according toclaim 19, wherein said command processing control includes: duringprocessing of a series of commands relating to said encryption keyexchange processing, managing an order of command processing based onsaid setting sequence and said command identifier; and not acceptingcommand processing from an external apparatus when said commandprocessing is different from said setting sequence.
 23. A non-transitoryrecording medium recorded with a computer program for executing dataprocessing having certain actions in a data processing system thatincludes a first apparatus and a second apparatus operable to transmitencryption data to each other, said actions comprising: receiving acommand identifier that is transferred from said first apparatus to saidsecond apparatus in accordance with a setting sequence, said settingsequence being a command number setting sequence in which numbers aresequentially incremented; retrieving, from a register, a command basedon said command identifier; processing said command; and when saidcommand identifier is different from said setting sequence, cancelingsaid processing of said command and not accepting command processingfrom any external apparatus during command execution relating to anencryption key exchange processing for encrypting data stored in astorage unit in said recording device.